xref: /freebsd/sys/dev/bwn/if_bwn.c (revision 09a53ad8f1318c5daae6cfb19d97f4f6459f0013)
1 /*-
2  * Copyright (c) 2009-2010 Weongyo Jeong <weongyo@freebsd.org>
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer,
10  *    without modification.
11  * 2. Redistributions in binary form must reproduce at minimum a disclaimer
12  *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
13  *    redistribution must be conditioned upon including a substantially
14  *    similar Disclaimer requirement for further binary redistribution.
15  *
16  * NO WARRANTY
17  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
18  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
19  * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
20  * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
21  * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
22  * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
23  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
24  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
25  * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
26  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
27  * THE POSSIBILITY OF SUCH DAMAGES.
28  */
29 
30 #include <sys/cdefs.h>
31 __FBSDID("$FreeBSD$");
32 
33 /*
34  * The Broadcom Wireless LAN controller driver.
35  */
36 
37 #include "opt_bwn.h"
38 #include "opt_wlan.h"
39 
40 #include <sys/param.h>
41 #include <sys/systm.h>
42 #include <sys/kernel.h>
43 #include <sys/malloc.h>
44 #include <sys/module.h>
45 #include <sys/endian.h>
46 #include <sys/errno.h>
47 #include <sys/firmware.h>
48 #include <sys/lock.h>
49 #include <sys/mutex.h>
50 #include <machine/bus.h>
51 #include <machine/resource.h>
52 #include <sys/bus.h>
53 #include <sys/rman.h>
54 #include <sys/socket.h>
55 #include <sys/sockio.h>
56 
57 #include <net/ethernet.h>
58 #include <net/if.h>
59 #include <net/if_var.h>
60 #include <net/if_arp.h>
61 #include <net/if_dl.h>
62 #include <net/if_llc.h>
63 #include <net/if_media.h>
64 #include <net/if_types.h>
65 
66 #include <dev/pci/pcivar.h>
67 #include <dev/pci/pcireg.h>
68 #include <dev/siba/siba_ids.h>
69 #include <dev/siba/sibareg.h>
70 #include <dev/siba/sibavar.h>
71 
72 #include <net80211/ieee80211_var.h>
73 #include <net80211/ieee80211_radiotap.h>
74 #include <net80211/ieee80211_regdomain.h>
75 #include <net80211/ieee80211_phy.h>
76 #include <net80211/ieee80211_ratectl.h>
77 
78 #include <dev/bwn/if_bwnreg.h>
79 #include <dev/bwn/if_bwnvar.h>
80 
81 #include <dev/bwn/if_bwn_debug.h>
82 #include <dev/bwn/if_bwn_misc.h>
83 #include <dev/bwn/if_bwn_util.h>
84 #include <dev/bwn/if_bwn_phy_common.h>
85 #include <dev/bwn/if_bwn_phy_g.h>
86 #include <dev/bwn/if_bwn_phy_lp.h>
87 #include <dev/bwn/if_bwn_phy_n.h>
88 
89 static SYSCTL_NODE(_hw, OID_AUTO, bwn, CTLFLAG_RD, 0,
90     "Broadcom driver parameters");
91 
92 /*
93  * Tunable & sysctl variables.
94  */
95 
96 #ifdef BWN_DEBUG
97 static	int bwn_debug = 0;
98 SYSCTL_INT(_hw_bwn, OID_AUTO, debug, CTLFLAG_RWTUN, &bwn_debug, 0,
99     "Broadcom debugging printfs");
100 #endif
101 
102 static int	bwn_bfp = 0;		/* use "Bad Frames Preemption" */
103 SYSCTL_INT(_hw_bwn, OID_AUTO, bfp, CTLFLAG_RW, &bwn_bfp, 0,
104     "uses Bad Frames Preemption");
105 static int	bwn_bluetooth = 1;
106 SYSCTL_INT(_hw_bwn, OID_AUTO, bluetooth, CTLFLAG_RW, &bwn_bluetooth, 0,
107     "turns on Bluetooth Coexistence");
108 static int	bwn_hwpctl = 0;
109 SYSCTL_INT(_hw_bwn, OID_AUTO, hwpctl, CTLFLAG_RW, &bwn_hwpctl, 0,
110     "uses H/W power control");
111 static int	bwn_msi_disable = 0;		/* MSI disabled  */
112 TUNABLE_INT("hw.bwn.msi_disable", &bwn_msi_disable);
113 static int	bwn_usedma = 1;
114 SYSCTL_INT(_hw_bwn, OID_AUTO, usedma, CTLFLAG_RD, &bwn_usedma, 0,
115     "uses DMA");
116 TUNABLE_INT("hw.bwn.usedma", &bwn_usedma);
117 static int	bwn_wme = 1;
118 SYSCTL_INT(_hw_bwn, OID_AUTO, wme, CTLFLAG_RW, &bwn_wme, 0,
119     "uses WME support");
120 
121 static void	bwn_attach_pre(struct bwn_softc *);
122 static int	bwn_attach_post(struct bwn_softc *);
123 static void	bwn_sprom_bugfixes(device_t);
124 static int	bwn_init(struct bwn_softc *);
125 static void	bwn_parent(struct ieee80211com *);
126 static void	bwn_start(struct bwn_softc *);
127 static int	bwn_transmit(struct ieee80211com *, struct mbuf *);
128 static int	bwn_attach_core(struct bwn_mac *);
129 static int	bwn_phy_getinfo(struct bwn_mac *, int);
130 static int	bwn_chiptest(struct bwn_mac *);
131 static int	bwn_setup_channels(struct bwn_mac *, int, int);
132 static void	bwn_shm_ctlword(struct bwn_mac *, uint16_t,
133 		    uint16_t);
134 static void	bwn_addchannels(struct ieee80211_channel [], int, int *,
135 		    const struct bwn_channelinfo *, const uint8_t []);
136 static int	bwn_raw_xmit(struct ieee80211_node *, struct mbuf *,
137 		    const struct ieee80211_bpf_params *);
138 static void	bwn_updateslot(struct ieee80211com *);
139 static void	bwn_update_promisc(struct ieee80211com *);
140 static void	bwn_wme_init(struct bwn_mac *);
141 static int	bwn_wme_update(struct ieee80211com *);
142 static void	bwn_wme_clear(struct bwn_softc *);
143 static void	bwn_wme_load(struct bwn_mac *);
144 static void	bwn_wme_loadparams(struct bwn_mac *,
145 		    const struct wmeParams *, uint16_t);
146 static void	bwn_scan_start(struct ieee80211com *);
147 static void	bwn_scan_end(struct ieee80211com *);
148 static void	bwn_set_channel(struct ieee80211com *);
149 static struct ieee80211vap *bwn_vap_create(struct ieee80211com *,
150 		    const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
151 		    const uint8_t [IEEE80211_ADDR_LEN],
152 		    const uint8_t [IEEE80211_ADDR_LEN]);
153 static void	bwn_vap_delete(struct ieee80211vap *);
154 static void	bwn_stop(struct bwn_softc *);
155 static int	bwn_core_init(struct bwn_mac *);
156 static void	bwn_core_start(struct bwn_mac *);
157 static void	bwn_core_exit(struct bwn_mac *);
158 static void	bwn_bt_disable(struct bwn_mac *);
159 static int	bwn_chip_init(struct bwn_mac *);
160 static void	bwn_set_txretry(struct bwn_mac *, int, int);
161 static void	bwn_rate_init(struct bwn_mac *);
162 static void	bwn_set_phytxctl(struct bwn_mac *);
163 static void	bwn_spu_setdelay(struct bwn_mac *, int);
164 static void	bwn_bt_enable(struct bwn_mac *);
165 static void	bwn_set_macaddr(struct bwn_mac *);
166 static void	bwn_crypt_init(struct bwn_mac *);
167 static void	bwn_chip_exit(struct bwn_mac *);
168 static int	bwn_fw_fillinfo(struct bwn_mac *);
169 static int	bwn_fw_loaducode(struct bwn_mac *);
170 static int	bwn_gpio_init(struct bwn_mac *);
171 static int	bwn_fw_loadinitvals(struct bwn_mac *);
172 static int	bwn_phy_init(struct bwn_mac *);
173 static void	bwn_set_txantenna(struct bwn_mac *, int);
174 static void	bwn_set_opmode(struct bwn_mac *);
175 static void	bwn_rate_write(struct bwn_mac *, uint16_t, int);
176 static uint8_t	bwn_plcp_getcck(const uint8_t);
177 static uint8_t	bwn_plcp_getofdm(const uint8_t);
178 static void	bwn_pio_init(struct bwn_mac *);
179 static uint16_t	bwn_pio_idx2base(struct bwn_mac *, int);
180 static void	bwn_pio_set_txqueue(struct bwn_mac *, struct bwn_pio_txqueue *,
181 		    int);
182 static void	bwn_pio_setupqueue_rx(struct bwn_mac *,
183 		    struct bwn_pio_rxqueue *, int);
184 static void	bwn_destroy_queue_tx(struct bwn_pio_txqueue *);
185 static uint16_t	bwn_pio_read_2(struct bwn_mac *, struct bwn_pio_txqueue *,
186 		    uint16_t);
187 static void	bwn_pio_cancel_tx_packets(struct bwn_pio_txqueue *);
188 static int	bwn_pio_rx(struct bwn_pio_rxqueue *);
189 static uint8_t	bwn_pio_rxeof(struct bwn_pio_rxqueue *);
190 static void	bwn_pio_handle_txeof(struct bwn_mac *,
191 		    const struct bwn_txstatus *);
192 static uint16_t	bwn_pio_rx_read_2(struct bwn_pio_rxqueue *, uint16_t);
193 static uint32_t	bwn_pio_rx_read_4(struct bwn_pio_rxqueue *, uint16_t);
194 static void	bwn_pio_rx_write_2(struct bwn_pio_rxqueue *, uint16_t,
195 		    uint16_t);
196 static void	bwn_pio_rx_write_4(struct bwn_pio_rxqueue *, uint16_t,
197 		    uint32_t);
198 static int	bwn_pio_tx_start(struct bwn_mac *, struct ieee80211_node *,
199 		    struct mbuf *);
200 static struct bwn_pio_txqueue *bwn_pio_select(struct bwn_mac *, uint8_t);
201 static uint32_t	bwn_pio_write_multi_4(struct bwn_mac *,
202 		    struct bwn_pio_txqueue *, uint32_t, const void *, int);
203 static void	bwn_pio_write_4(struct bwn_mac *, struct bwn_pio_txqueue *,
204 		    uint16_t, uint32_t);
205 static uint16_t	bwn_pio_write_multi_2(struct bwn_mac *,
206 		    struct bwn_pio_txqueue *, uint16_t, const void *, int);
207 static uint16_t	bwn_pio_write_mbuf_2(struct bwn_mac *,
208 		    struct bwn_pio_txqueue *, uint16_t, struct mbuf *);
209 static struct bwn_pio_txqueue *bwn_pio_parse_cookie(struct bwn_mac *,
210 		    uint16_t, struct bwn_pio_txpkt **);
211 static void	bwn_dma_init(struct bwn_mac *);
212 static void	bwn_dma_rxdirectfifo(struct bwn_mac *, int, uint8_t);
213 static int	bwn_dma_mask2type(uint64_t);
214 static uint64_t	bwn_dma_mask(struct bwn_mac *);
215 static uint16_t	bwn_dma_base(int, int);
216 static void	bwn_dma_ringfree(struct bwn_dma_ring **);
217 static void	bwn_dma_32_getdesc(struct bwn_dma_ring *,
218 		    int, struct bwn_dmadesc_generic **,
219 		    struct bwn_dmadesc_meta **);
220 static void	bwn_dma_32_setdesc(struct bwn_dma_ring *,
221 		    struct bwn_dmadesc_generic *, bus_addr_t, uint16_t, int,
222 		    int, int);
223 static void	bwn_dma_32_start_transfer(struct bwn_dma_ring *, int);
224 static void	bwn_dma_32_suspend(struct bwn_dma_ring *);
225 static void	bwn_dma_32_resume(struct bwn_dma_ring *);
226 static int	bwn_dma_32_get_curslot(struct bwn_dma_ring *);
227 static void	bwn_dma_32_set_curslot(struct bwn_dma_ring *, int);
228 static void	bwn_dma_64_getdesc(struct bwn_dma_ring *,
229 		    int, struct bwn_dmadesc_generic **,
230 		    struct bwn_dmadesc_meta **);
231 static void	bwn_dma_64_setdesc(struct bwn_dma_ring *,
232 		    struct bwn_dmadesc_generic *, bus_addr_t, uint16_t, int,
233 		    int, int);
234 static void	bwn_dma_64_start_transfer(struct bwn_dma_ring *, int);
235 static void	bwn_dma_64_suspend(struct bwn_dma_ring *);
236 static void	bwn_dma_64_resume(struct bwn_dma_ring *);
237 static int	bwn_dma_64_get_curslot(struct bwn_dma_ring *);
238 static void	bwn_dma_64_set_curslot(struct bwn_dma_ring *, int);
239 static int	bwn_dma_allocringmemory(struct bwn_dma_ring *);
240 static void	bwn_dma_setup(struct bwn_dma_ring *);
241 static void	bwn_dma_free_ringmemory(struct bwn_dma_ring *);
242 static void	bwn_dma_cleanup(struct bwn_dma_ring *);
243 static void	bwn_dma_free_descbufs(struct bwn_dma_ring *);
244 static int	bwn_dma_tx_reset(struct bwn_mac *, uint16_t, int);
245 static void	bwn_dma_rx(struct bwn_dma_ring *);
246 static int	bwn_dma_rx_reset(struct bwn_mac *, uint16_t, int);
247 static void	bwn_dma_free_descbuf(struct bwn_dma_ring *,
248 		    struct bwn_dmadesc_meta *);
249 static void	bwn_dma_set_redzone(struct bwn_dma_ring *, struct mbuf *);
250 static int	bwn_dma_gettype(struct bwn_mac *);
251 static void	bwn_dma_ring_addr(void *, bus_dma_segment_t *, int, int);
252 static int	bwn_dma_freeslot(struct bwn_dma_ring *);
253 static int	bwn_dma_nextslot(struct bwn_dma_ring *, int);
254 static void	bwn_dma_rxeof(struct bwn_dma_ring *, int *);
255 static int	bwn_dma_newbuf(struct bwn_dma_ring *,
256 		    struct bwn_dmadesc_generic *, struct bwn_dmadesc_meta *,
257 		    int);
258 static void	bwn_dma_buf_addr(void *, bus_dma_segment_t *, int,
259 		    bus_size_t, int);
260 static uint8_t	bwn_dma_check_redzone(struct bwn_dma_ring *, struct mbuf *);
261 static void	bwn_dma_handle_txeof(struct bwn_mac *,
262 		    const struct bwn_txstatus *);
263 static int	bwn_dma_tx_start(struct bwn_mac *, struct ieee80211_node *,
264 		    struct mbuf *);
265 static int	bwn_dma_getslot(struct bwn_dma_ring *);
266 static struct bwn_dma_ring *bwn_dma_select(struct bwn_mac *,
267 		    uint8_t);
268 static int	bwn_dma_attach(struct bwn_mac *);
269 static struct bwn_dma_ring *bwn_dma_ringsetup(struct bwn_mac *,
270 		    int, int, int);
271 static struct bwn_dma_ring *bwn_dma_parse_cookie(struct bwn_mac *,
272 		    const struct bwn_txstatus *, uint16_t, int *);
273 static void	bwn_dma_free(struct bwn_mac *);
274 static int	bwn_fw_gets(struct bwn_mac *, enum bwn_fwtype);
275 static int	bwn_fw_get(struct bwn_mac *, enum bwn_fwtype,
276 		    const char *, struct bwn_fwfile *);
277 static void	bwn_release_firmware(struct bwn_mac *);
278 static void	bwn_do_release_fw(struct bwn_fwfile *);
279 static uint16_t	bwn_fwcaps_read(struct bwn_mac *);
280 static int	bwn_fwinitvals_write(struct bwn_mac *,
281 		    const struct bwn_fwinitvals *, size_t, size_t);
282 static uint16_t	bwn_ant2phy(int);
283 static void	bwn_mac_write_bssid(struct bwn_mac *);
284 static void	bwn_mac_setfilter(struct bwn_mac *, uint16_t,
285 		    const uint8_t *);
286 static void	bwn_key_dowrite(struct bwn_mac *, uint8_t, uint8_t,
287 		    const uint8_t *, size_t, const uint8_t *);
288 static void	bwn_key_macwrite(struct bwn_mac *, uint8_t,
289 		    const uint8_t *);
290 static void	bwn_key_write(struct bwn_mac *, uint8_t, uint8_t,
291 		    const uint8_t *);
292 static void	bwn_phy_exit(struct bwn_mac *);
293 static void	bwn_core_stop(struct bwn_mac *);
294 static int	bwn_switch_band(struct bwn_softc *,
295 		    struct ieee80211_channel *);
296 static void	bwn_phy_reset(struct bwn_mac *);
297 static int	bwn_newstate(struct ieee80211vap *, enum ieee80211_state, int);
298 static void	bwn_set_pretbtt(struct bwn_mac *);
299 static int	bwn_intr(void *);
300 static void	bwn_intrtask(void *, int);
301 static void	bwn_restart(struct bwn_mac *, const char *);
302 static void	bwn_intr_ucode_debug(struct bwn_mac *);
303 static void	bwn_intr_tbtt_indication(struct bwn_mac *);
304 static void	bwn_intr_atim_end(struct bwn_mac *);
305 static void	bwn_intr_beacon(struct bwn_mac *);
306 static void	bwn_intr_pmq(struct bwn_mac *);
307 static void	bwn_intr_noise(struct bwn_mac *);
308 static void	bwn_intr_txeof(struct bwn_mac *);
309 static void	bwn_hwreset(void *, int);
310 static void	bwn_handle_fwpanic(struct bwn_mac *);
311 static void	bwn_load_beacon0(struct bwn_mac *);
312 static void	bwn_load_beacon1(struct bwn_mac *);
313 static uint32_t	bwn_jssi_read(struct bwn_mac *);
314 static void	bwn_noise_gensample(struct bwn_mac *);
315 static void	bwn_handle_txeof(struct bwn_mac *,
316 		    const struct bwn_txstatus *);
317 static void	bwn_rxeof(struct bwn_mac *, struct mbuf *, const void *);
318 static void	bwn_phy_txpower_check(struct bwn_mac *, uint32_t);
319 static int	bwn_tx_start(struct bwn_softc *, struct ieee80211_node *,
320 		    struct mbuf *);
321 static int	bwn_tx_isfull(struct bwn_softc *, struct mbuf *);
322 static int	bwn_set_txhdr(struct bwn_mac *,
323 		    struct ieee80211_node *, struct mbuf *, struct bwn_txhdr *,
324 		    uint16_t);
325 static void	bwn_plcp_genhdr(struct bwn_plcp4 *, const uint16_t,
326 		    const uint8_t);
327 static uint8_t	bwn_antenna_sanitize(struct bwn_mac *, uint8_t);
328 static uint8_t	bwn_get_fbrate(uint8_t);
329 static void	bwn_txpwr(void *, int);
330 static void	bwn_tasks(void *);
331 static void	bwn_task_15s(struct bwn_mac *);
332 static void	bwn_task_30s(struct bwn_mac *);
333 static void	bwn_task_60s(struct bwn_mac *);
334 static int	bwn_plcp_get_ofdmrate(struct bwn_mac *, struct bwn_plcp6 *,
335 		    uint8_t);
336 static int	bwn_plcp_get_cckrate(struct bwn_mac *, struct bwn_plcp6 *);
337 static void	bwn_rx_radiotap(struct bwn_mac *, struct mbuf *,
338 		    const struct bwn_rxhdr4 *, struct bwn_plcp6 *, int,
339 		    int, int);
340 static void	bwn_tsf_read(struct bwn_mac *, uint64_t *);
341 static void	bwn_set_slot_time(struct bwn_mac *, uint16_t);
342 static void	bwn_watchdog(void *);
343 static void	bwn_dma_stop(struct bwn_mac *);
344 static void	bwn_pio_stop(struct bwn_mac *);
345 static void	bwn_dma_ringstop(struct bwn_dma_ring **);
346 static void	bwn_led_attach(struct bwn_mac *);
347 static void	bwn_led_newstate(struct bwn_mac *, enum ieee80211_state);
348 static void	bwn_led_event(struct bwn_mac *, int);
349 static void	bwn_led_blink_start(struct bwn_mac *, int, int);
350 static void	bwn_led_blink_next(void *);
351 static void	bwn_led_blink_end(void *);
352 static void	bwn_rfswitch(void *);
353 static void	bwn_rf_turnon(struct bwn_mac *);
354 static void	bwn_rf_turnoff(struct bwn_mac *);
355 static void	bwn_sysctl_node(struct bwn_softc *);
356 
357 static struct resource_spec bwn_res_spec_legacy[] = {
358 	{ SYS_RES_IRQ,		0,		RF_ACTIVE | RF_SHAREABLE },
359 	{ -1,			0,		0 }
360 };
361 
362 static struct resource_spec bwn_res_spec_msi[] = {
363 	{ SYS_RES_IRQ,		1,		RF_ACTIVE },
364 	{ -1,			0,		0 }
365 };
366 
367 static const struct bwn_channelinfo bwn_chantable_bg = {
368 	.channels = {
369 		{ 2412,  1, 30 }, { 2417,  2, 30 }, { 2422,  3, 30 },
370 		{ 2427,  4, 30 }, { 2432,  5, 30 }, { 2437,  6, 30 },
371 		{ 2442,  7, 30 }, { 2447,  8, 30 }, { 2452,  9, 30 },
372 		{ 2457, 10, 30 }, { 2462, 11, 30 }, { 2467, 12, 30 },
373 		{ 2472, 13, 30 }, { 2484, 14, 30 } },
374 	.nchannels = 14
375 };
376 
377 static const struct bwn_channelinfo bwn_chantable_a = {
378 	.channels = {
379 		{ 5170,  34, 30 }, { 5180,  36, 30 }, { 5190,  38, 30 },
380 		{ 5200,  40, 30 }, { 5210,  42, 30 }, { 5220,  44, 30 },
381 		{ 5230,  46, 30 }, { 5240,  48, 30 }, { 5260,  52, 30 },
382 		{ 5280,  56, 30 }, { 5300,  60, 30 }, { 5320,  64, 30 },
383 		{ 5500, 100, 30 }, { 5520, 104, 30 }, { 5540, 108, 30 },
384 		{ 5560, 112, 30 }, { 5580, 116, 30 }, { 5600, 120, 30 },
385 		{ 5620, 124, 30 }, { 5640, 128, 30 }, { 5660, 132, 30 },
386 		{ 5680, 136, 30 }, { 5700, 140, 30 }, { 5745, 149, 30 },
387 		{ 5765, 153, 30 }, { 5785, 157, 30 }, { 5805, 161, 30 },
388 		{ 5825, 165, 30 }, { 5920, 184, 30 }, { 5940, 188, 30 },
389 		{ 5960, 192, 30 }, { 5980, 196, 30 }, { 6000, 200, 30 },
390 		{ 6020, 204, 30 }, { 6040, 208, 30 }, { 6060, 212, 30 },
391 		{ 6080, 216, 30 } },
392 	.nchannels = 37
393 };
394 
395 #if 0
396 static const struct bwn_channelinfo bwn_chantable_n = {
397 	.channels = {
398 		{ 5160,  32, 30 }, { 5170,  34, 30 }, { 5180,  36, 30 },
399 		{ 5190,  38, 30 }, { 5200,  40, 30 }, { 5210,  42, 30 },
400 		{ 5220,  44, 30 }, { 5230,  46, 30 }, { 5240,  48, 30 },
401 		{ 5250,  50, 30 }, { 5260,  52, 30 }, { 5270,  54, 30 },
402 		{ 5280,  56, 30 }, { 5290,  58, 30 }, { 5300,  60, 30 },
403 		{ 5310,  62, 30 }, { 5320,  64, 30 }, { 5330,  66, 30 },
404 		{ 5340,  68, 30 }, { 5350,  70, 30 }, { 5360,  72, 30 },
405 		{ 5370,  74, 30 }, { 5380,  76, 30 }, { 5390,  78, 30 },
406 		{ 5400,  80, 30 }, { 5410,  82, 30 }, { 5420,  84, 30 },
407 		{ 5430,  86, 30 }, { 5440,  88, 30 }, { 5450,  90, 30 },
408 		{ 5460,  92, 30 }, { 5470,  94, 30 }, { 5480,  96, 30 },
409 		{ 5490,  98, 30 }, { 5500, 100, 30 }, { 5510, 102, 30 },
410 		{ 5520, 104, 30 }, { 5530, 106, 30 }, { 5540, 108, 30 },
411 		{ 5550, 110, 30 }, { 5560, 112, 30 }, { 5570, 114, 30 },
412 		{ 5580, 116, 30 }, { 5590, 118, 30 }, { 5600, 120, 30 },
413 		{ 5610, 122, 30 }, { 5620, 124, 30 }, { 5630, 126, 30 },
414 		{ 5640, 128, 30 }, { 5650, 130, 30 }, { 5660, 132, 30 },
415 		{ 5670, 134, 30 }, { 5680, 136, 30 }, { 5690, 138, 30 },
416 		{ 5700, 140, 30 }, { 5710, 142, 30 }, { 5720, 144, 30 },
417 		{ 5725, 145, 30 }, { 5730, 146, 30 }, { 5735, 147, 30 },
418 		{ 5740, 148, 30 }, { 5745, 149, 30 }, { 5750, 150, 30 },
419 		{ 5755, 151, 30 }, { 5760, 152, 30 }, { 5765, 153, 30 },
420 		{ 5770, 154, 30 }, { 5775, 155, 30 }, { 5780, 156, 30 },
421 		{ 5785, 157, 30 }, { 5790, 158, 30 }, { 5795, 159, 30 },
422 		{ 5800, 160, 30 }, { 5805, 161, 30 }, { 5810, 162, 30 },
423 		{ 5815, 163, 30 }, { 5820, 164, 30 }, { 5825, 165, 30 },
424 		{ 5830, 166, 30 }, { 5840, 168, 30 }, { 5850, 170, 30 },
425 		{ 5860, 172, 30 }, { 5870, 174, 30 }, { 5880, 176, 30 },
426 		{ 5890, 178, 30 }, { 5900, 180, 30 }, { 5910, 182, 30 },
427 		{ 5920, 184, 30 }, { 5930, 186, 30 }, { 5940, 188, 30 },
428 		{ 5950, 190, 30 }, { 5960, 192, 30 }, { 5970, 194, 30 },
429 		{ 5980, 196, 30 }, { 5990, 198, 30 }, { 6000, 200, 30 },
430 		{ 6010, 202, 30 }, { 6020, 204, 30 }, { 6030, 206, 30 },
431 		{ 6040, 208, 30 }, { 6050, 210, 30 }, { 6060, 212, 30 },
432 		{ 6070, 214, 30 }, { 6080, 216, 30 }, { 6090, 218, 30 },
433 		{ 6100, 220, 30 }, { 6110, 222, 30 }, { 6120, 224, 30 },
434 		{ 6130, 226, 30 }, { 6140, 228, 30 } },
435 	.nchannels = 110
436 };
437 #endif
438 
439 #define	VENDOR_LED_ACT(vendor)				\
440 {							\
441 	.vid = PCI_VENDOR_##vendor,			\
442 	.led_act = { BWN_VENDOR_LED_ACT_##vendor }	\
443 }
444 
445 static const struct {
446 	uint16_t	vid;
447 	uint8_t		led_act[BWN_LED_MAX];
448 } bwn_vendor_led_act[] = {
449 	VENDOR_LED_ACT(COMPAQ),
450 	VENDOR_LED_ACT(ASUSTEK)
451 };
452 
453 static const uint8_t bwn_default_led_act[BWN_LED_MAX] =
454 	{ BWN_VENDOR_LED_ACT_DEFAULT };
455 
456 #undef VENDOR_LED_ACT
457 
458 static const struct {
459 	int		on_dur;
460 	int		off_dur;
461 } bwn_led_duration[109] = {
462 	[0]	= { 400, 100 },
463 	[2]	= { 150, 75 },
464 	[4]	= { 90, 45 },
465 	[11]	= { 66, 34 },
466 	[12]	= { 53, 26 },
467 	[18]	= { 42, 21 },
468 	[22]	= { 35, 17 },
469 	[24]	= { 32, 16 },
470 	[36]	= { 21, 10 },
471 	[48]	= { 16, 8 },
472 	[72]	= { 11, 5 },
473 	[96]	= { 9, 4 },
474 	[108]	= { 7, 3 }
475 };
476 
477 static const uint16_t bwn_wme_shm_offsets[] = {
478 	[0] = BWN_WME_BESTEFFORT,
479 	[1] = BWN_WME_BACKGROUND,
480 	[2] = BWN_WME_VOICE,
481 	[3] = BWN_WME_VIDEO,
482 };
483 
484 static const struct siba_devid bwn_devs[] = {
485 	SIBA_DEV(BROADCOM, 80211, 5, "Revision 5"),
486 	SIBA_DEV(BROADCOM, 80211, 6, "Revision 6"),
487 	SIBA_DEV(BROADCOM, 80211, 7, "Revision 7"),
488 	SIBA_DEV(BROADCOM, 80211, 9, "Revision 9"),
489 	SIBA_DEV(BROADCOM, 80211, 10, "Revision 10"),
490 	SIBA_DEV(BROADCOM, 80211, 11, "Revision 11"),
491 	SIBA_DEV(BROADCOM, 80211, 12, "Revision 12"),
492 	SIBA_DEV(BROADCOM, 80211, 13, "Revision 13"),
493 	SIBA_DEV(BROADCOM, 80211, 15, "Revision 15"),
494 	SIBA_DEV(BROADCOM, 80211, 16, "Revision 16")
495 };
496 
497 static int
498 bwn_probe(device_t dev)
499 {
500 	int i;
501 
502 	for (i = 0; i < nitems(bwn_devs); i++) {
503 		if (siba_get_vendor(dev) == bwn_devs[i].sd_vendor &&
504 		    siba_get_device(dev) == bwn_devs[i].sd_device &&
505 		    siba_get_revid(dev) == bwn_devs[i].sd_rev)
506 			return (BUS_PROBE_DEFAULT);
507 	}
508 
509 	return (ENXIO);
510 }
511 
512 static int
513 bwn_attach(device_t dev)
514 {
515 	struct bwn_mac *mac;
516 	struct bwn_softc *sc = device_get_softc(dev);
517 	int error, i, msic, reg;
518 
519 	sc->sc_dev = dev;
520 #ifdef BWN_DEBUG
521 	sc->sc_debug = bwn_debug;
522 #endif
523 
524 	if ((sc->sc_flags & BWN_FLAG_ATTACHED) == 0) {
525 		bwn_attach_pre(sc);
526 		bwn_sprom_bugfixes(dev);
527 		sc->sc_flags |= BWN_FLAG_ATTACHED;
528 	}
529 
530 	if (!TAILQ_EMPTY(&sc->sc_maclist)) {
531 		if (siba_get_pci_device(dev) != 0x4313 &&
532 		    siba_get_pci_device(dev) != 0x431a &&
533 		    siba_get_pci_device(dev) != 0x4321) {
534 			device_printf(sc->sc_dev,
535 			    "skip 802.11 cores\n");
536 			return (ENODEV);
537 		}
538 	}
539 
540 	mac = malloc(sizeof(*mac), M_DEVBUF, M_WAITOK | M_ZERO);
541 	mac->mac_sc = sc;
542 	mac->mac_status = BWN_MAC_STATUS_UNINIT;
543 	if (bwn_bfp != 0)
544 		mac->mac_flags |= BWN_MAC_FLAG_BADFRAME_PREEMP;
545 
546 	TASK_INIT(&mac->mac_hwreset, 0, bwn_hwreset, mac);
547 	TASK_INIT(&mac->mac_intrtask, 0, bwn_intrtask, mac);
548 	TASK_INIT(&mac->mac_txpower, 0, bwn_txpwr, mac);
549 
550 	error = bwn_attach_core(mac);
551 	if (error)
552 		goto fail0;
553 	bwn_led_attach(mac);
554 
555 	device_printf(sc->sc_dev, "WLAN (chipid %#x rev %u) "
556 	    "PHY (analog %d type %d rev %d) RADIO (manuf %#x ver %#x rev %d)\n",
557 	    siba_get_chipid(sc->sc_dev), siba_get_revid(sc->sc_dev),
558 	    mac->mac_phy.analog, mac->mac_phy.type, mac->mac_phy.rev,
559 	    mac->mac_phy.rf_manuf, mac->mac_phy.rf_ver,
560 	    mac->mac_phy.rf_rev);
561 	if (mac->mac_flags & BWN_MAC_FLAG_DMA)
562 		device_printf(sc->sc_dev, "DMA (%d bits)\n",
563 		    mac->mac_method.dma.dmatype);
564 	else
565 		device_printf(sc->sc_dev, "PIO\n");
566 
567 #ifdef	BWN_GPL_PHY
568 	device_printf(sc->sc_dev,
569 	    "Note: compiled with BWN_GPL_PHY; includes GPLv2 code\n");
570 #endif
571 
572 	/*
573 	 * setup PCI resources and interrupt.
574 	 */
575 	if (pci_find_cap(dev, PCIY_EXPRESS, &reg) == 0) {
576 		msic = pci_msi_count(dev);
577 		if (bootverbose)
578 			device_printf(sc->sc_dev, "MSI count : %d\n", msic);
579 	} else
580 		msic = 0;
581 
582 	mac->mac_intr_spec = bwn_res_spec_legacy;
583 	if (msic == BWN_MSI_MESSAGES && bwn_msi_disable == 0) {
584 		if (pci_alloc_msi(dev, &msic) == 0) {
585 			device_printf(sc->sc_dev,
586 			    "Using %d MSI messages\n", msic);
587 			mac->mac_intr_spec = bwn_res_spec_msi;
588 			mac->mac_msi = 1;
589 		}
590 	}
591 
592 	error = bus_alloc_resources(dev, mac->mac_intr_spec,
593 	    mac->mac_res_irq);
594 	if (error) {
595 		device_printf(sc->sc_dev,
596 		    "couldn't allocate IRQ resources (%d)\n", error);
597 		goto fail1;
598 	}
599 
600 	if (mac->mac_msi == 0)
601 		error = bus_setup_intr(dev, mac->mac_res_irq[0],
602 		    INTR_TYPE_NET | INTR_MPSAFE, bwn_intr, NULL, mac,
603 		    &mac->mac_intrhand[0]);
604 	else {
605 		for (i = 0; i < BWN_MSI_MESSAGES; i++) {
606 			error = bus_setup_intr(dev, mac->mac_res_irq[i],
607 			    INTR_TYPE_NET | INTR_MPSAFE, bwn_intr, NULL, mac,
608 			    &mac->mac_intrhand[i]);
609 			if (error != 0) {
610 				device_printf(sc->sc_dev,
611 				    "couldn't setup interrupt (%d)\n", error);
612 				break;
613 			}
614 		}
615 	}
616 
617 	TAILQ_INSERT_TAIL(&sc->sc_maclist, mac, mac_list);
618 
619 	/*
620 	 * calls attach-post routine
621 	 */
622 	if ((sc->sc_flags & BWN_FLAG_ATTACHED) != 0)
623 		bwn_attach_post(sc);
624 
625 	return (0);
626 fail1:
627 	if (msic == BWN_MSI_MESSAGES && bwn_msi_disable == 0)
628 		pci_release_msi(dev);
629 fail0:
630 	free(mac, M_DEVBUF);
631 	return (error);
632 }
633 
634 static int
635 bwn_is_valid_ether_addr(uint8_t *addr)
636 {
637 	char zero_addr[6] = { 0, 0, 0, 0, 0, 0 };
638 
639 	if ((addr[0] & 1) || (!bcmp(addr, zero_addr, ETHER_ADDR_LEN)))
640 		return (FALSE);
641 
642 	return (TRUE);
643 }
644 
645 static int
646 bwn_attach_post(struct bwn_softc *sc)
647 {
648 	struct ieee80211com *ic = &sc->sc_ic;
649 
650 	ic->ic_softc = sc;
651 	ic->ic_name = device_get_nameunit(sc->sc_dev);
652 	/* XXX not right but it's not used anywhere important */
653 	ic->ic_phytype = IEEE80211_T_OFDM;
654 	ic->ic_opmode = IEEE80211_M_STA;
655 	ic->ic_caps =
656 		  IEEE80211_C_STA		/* station mode supported */
657 		| IEEE80211_C_MONITOR		/* monitor mode */
658 		| IEEE80211_C_AHDEMO		/* adhoc demo mode */
659 		| IEEE80211_C_SHPREAMBLE	/* short preamble supported */
660 		| IEEE80211_C_SHSLOT		/* short slot time supported */
661 		| IEEE80211_C_WME		/* WME/WMM supported */
662 		| IEEE80211_C_WPA		/* capable of WPA1+WPA2 */
663 #if 0
664 		| IEEE80211_C_BGSCAN		/* capable of bg scanning */
665 #endif
666 		| IEEE80211_C_TXPMGT		/* capable of txpow mgt */
667 		;
668 
669 	ic->ic_flags_ext |= IEEE80211_FEXT_SWBMISS;	/* s/w bmiss */
670 
671 	IEEE80211_ADDR_COPY(ic->ic_macaddr,
672 	    bwn_is_valid_ether_addr(siba_sprom_get_mac_80211a(sc->sc_dev)) ?
673 	    siba_sprom_get_mac_80211a(sc->sc_dev) :
674 	    siba_sprom_get_mac_80211bg(sc->sc_dev));
675 
676 	/* call MI attach routine. */
677 	ieee80211_ifattach(ic);
678 
679 	ic->ic_headroom = sizeof(struct bwn_txhdr);
680 
681 	/* override default methods */
682 	ic->ic_raw_xmit = bwn_raw_xmit;
683 	ic->ic_updateslot = bwn_updateslot;
684 	ic->ic_update_promisc = bwn_update_promisc;
685 	ic->ic_wme.wme_update = bwn_wme_update;
686 	ic->ic_scan_start = bwn_scan_start;
687 	ic->ic_scan_end = bwn_scan_end;
688 	ic->ic_set_channel = bwn_set_channel;
689 	ic->ic_vap_create = bwn_vap_create;
690 	ic->ic_vap_delete = bwn_vap_delete;
691 	ic->ic_transmit = bwn_transmit;
692 	ic->ic_parent = bwn_parent;
693 
694 	ieee80211_radiotap_attach(ic,
695 	    &sc->sc_tx_th.wt_ihdr, sizeof(sc->sc_tx_th),
696 	    BWN_TX_RADIOTAP_PRESENT,
697 	    &sc->sc_rx_th.wr_ihdr, sizeof(sc->sc_rx_th),
698 	    BWN_RX_RADIOTAP_PRESENT);
699 
700 	bwn_sysctl_node(sc);
701 
702 	if (bootverbose)
703 		ieee80211_announce(ic);
704 	return (0);
705 }
706 
707 static void
708 bwn_phy_detach(struct bwn_mac *mac)
709 {
710 
711 	if (mac->mac_phy.detach != NULL)
712 		mac->mac_phy.detach(mac);
713 }
714 
715 static int
716 bwn_detach(device_t dev)
717 {
718 	struct bwn_softc *sc = device_get_softc(dev);
719 	struct bwn_mac *mac = sc->sc_curmac;
720 	struct ieee80211com *ic = &sc->sc_ic;
721 	int i;
722 
723 	sc->sc_flags |= BWN_FLAG_INVALID;
724 
725 	if (device_is_attached(sc->sc_dev)) {
726 		BWN_LOCK(sc);
727 		bwn_stop(sc);
728 		BWN_UNLOCK(sc);
729 		bwn_dma_free(mac);
730 		callout_drain(&sc->sc_led_blink_ch);
731 		callout_drain(&sc->sc_rfswitch_ch);
732 		callout_drain(&sc->sc_task_ch);
733 		callout_drain(&sc->sc_watchdog_ch);
734 		bwn_phy_detach(mac);
735 		ieee80211_draintask(ic, &mac->mac_hwreset);
736 		ieee80211_draintask(ic, &mac->mac_txpower);
737 		ieee80211_ifdetach(ic);
738 	}
739 	taskqueue_drain(sc->sc_tq, &mac->mac_intrtask);
740 	taskqueue_free(sc->sc_tq);
741 
742 	for (i = 0; i < BWN_MSI_MESSAGES; i++) {
743 		if (mac->mac_intrhand[i] != NULL) {
744 			bus_teardown_intr(dev, mac->mac_res_irq[i],
745 			    mac->mac_intrhand[i]);
746 			mac->mac_intrhand[i] = NULL;
747 		}
748 	}
749 	bus_release_resources(dev, mac->mac_intr_spec, mac->mac_res_irq);
750 	if (mac->mac_msi != 0)
751 		pci_release_msi(dev);
752 	mbufq_drain(&sc->sc_snd);
753 	bwn_release_firmware(mac);
754 	BWN_LOCK_DESTROY(sc);
755 	return (0);
756 }
757 
758 static void
759 bwn_attach_pre(struct bwn_softc *sc)
760 {
761 
762 	BWN_LOCK_INIT(sc);
763 	TAILQ_INIT(&sc->sc_maclist);
764 	callout_init_mtx(&sc->sc_rfswitch_ch, &sc->sc_mtx, 0);
765 	callout_init_mtx(&sc->sc_task_ch, &sc->sc_mtx, 0);
766 	callout_init_mtx(&sc->sc_watchdog_ch, &sc->sc_mtx, 0);
767 	mbufq_init(&sc->sc_snd, ifqmaxlen);
768 	sc->sc_tq = taskqueue_create_fast("bwn_taskq", M_NOWAIT,
769 		taskqueue_thread_enqueue, &sc->sc_tq);
770 	taskqueue_start_threads(&sc->sc_tq, 1, PI_NET,
771 		"%s taskq", device_get_nameunit(sc->sc_dev));
772 }
773 
774 static void
775 bwn_sprom_bugfixes(device_t dev)
776 {
777 #define	BWN_ISDEV(_vendor, _device, _subvendor, _subdevice)		\
778 	((siba_get_pci_vendor(dev) == PCI_VENDOR_##_vendor) &&		\
779 	 (siba_get_pci_device(dev) == _device) &&			\
780 	 (siba_get_pci_subvendor(dev) == PCI_VENDOR_##_subvendor) &&	\
781 	 (siba_get_pci_subdevice(dev) == _subdevice))
782 
783 	if (siba_get_pci_subvendor(dev) == PCI_VENDOR_APPLE &&
784 	    siba_get_pci_subdevice(dev) == 0x4e &&
785 	    siba_get_pci_revid(dev) > 0x40)
786 		siba_sprom_set_bf_lo(dev,
787 		    siba_sprom_get_bf_lo(dev) | BWN_BFL_PACTRL);
788 	if (siba_get_pci_subvendor(dev) == SIBA_BOARDVENDOR_DELL &&
789 	    siba_get_chipid(dev) == 0x4301 && siba_get_pci_revid(dev) == 0x74)
790 		siba_sprom_set_bf_lo(dev,
791 		    siba_sprom_get_bf_lo(dev) | BWN_BFL_BTCOEXIST);
792 	if (siba_get_type(dev) == SIBA_TYPE_PCI) {
793 		if (BWN_ISDEV(BROADCOM, 0x4318, ASUSTEK, 0x100f) ||
794 		    BWN_ISDEV(BROADCOM, 0x4320, DELL, 0x0003) ||
795 		    BWN_ISDEV(BROADCOM, 0x4320, HP, 0x12f8) ||
796 		    BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0013) ||
797 		    BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0014) ||
798 		    BWN_ISDEV(BROADCOM, 0x4320, LINKSYS, 0x0015) ||
799 		    BWN_ISDEV(BROADCOM, 0x4320, MOTOROLA, 0x7010))
800 			siba_sprom_set_bf_lo(dev,
801 			    siba_sprom_get_bf_lo(dev) & ~BWN_BFL_BTCOEXIST);
802 	}
803 #undef	BWN_ISDEV
804 }
805 
806 static void
807 bwn_parent(struct ieee80211com *ic)
808 {
809 	struct bwn_softc *sc = ic->ic_softc;
810 	int startall = 0;
811 
812 	BWN_LOCK(sc);
813 	if (ic->ic_nrunning > 0) {
814 		if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0) {
815 			bwn_init(sc);
816 			startall = 1;
817 		} else
818 			bwn_update_promisc(ic);
819 	} else if (sc->sc_flags & BWN_FLAG_RUNNING)
820 		bwn_stop(sc);
821 	BWN_UNLOCK(sc);
822 
823 	if (startall)
824 		ieee80211_start_all(ic);
825 }
826 
827 static int
828 bwn_transmit(struct ieee80211com *ic, struct mbuf *m)
829 {
830 	struct bwn_softc *sc = ic->ic_softc;
831 	int error;
832 
833 	BWN_LOCK(sc);
834 	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0) {
835 		BWN_UNLOCK(sc);
836 		return (ENXIO);
837 	}
838 	error = mbufq_enqueue(&sc->sc_snd, m);
839 	if (error) {
840 		BWN_UNLOCK(sc);
841 		return (error);
842 	}
843 	bwn_start(sc);
844 	BWN_UNLOCK(sc);
845 	return (0);
846 }
847 
848 static void
849 bwn_start(struct bwn_softc *sc)
850 {
851 	struct bwn_mac *mac = sc->sc_curmac;
852 	struct ieee80211_frame *wh;
853 	struct ieee80211_node *ni;
854 	struct ieee80211_key *k;
855 	struct mbuf *m;
856 
857 	BWN_ASSERT_LOCKED(sc);
858 
859 	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0 || mac == NULL ||
860 	    mac->mac_status < BWN_MAC_STATUS_STARTED)
861 		return;
862 
863 	while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
864 		if (bwn_tx_isfull(sc, m))
865 			break;
866 		ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
867 		if (ni == NULL) {
868 			device_printf(sc->sc_dev, "unexpected NULL ni\n");
869 			m_freem(m);
870 			counter_u64_add(sc->sc_ic.ic_oerrors, 1);
871 			continue;
872 		}
873 		wh = mtod(m, struct ieee80211_frame *);
874 		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
875 			k = ieee80211_crypto_encap(ni, m);
876 			if (k == NULL) {
877 				if_inc_counter(ni->ni_vap->iv_ifp,
878 				    IFCOUNTER_OERRORS, 1);
879 				ieee80211_free_node(ni);
880 				m_freem(m);
881 				continue;
882 			}
883 		}
884 		wh = NULL;	/* Catch any invalid use */
885 		if (bwn_tx_start(sc, ni, m) != 0) {
886 			if (ni != NULL) {
887 				if_inc_counter(ni->ni_vap->iv_ifp,
888 				    IFCOUNTER_OERRORS, 1);
889 				ieee80211_free_node(ni);
890 			}
891 			continue;
892 		}
893 		sc->sc_watchdog_timer = 5;
894 	}
895 }
896 
897 static int
898 bwn_tx_isfull(struct bwn_softc *sc, struct mbuf *m)
899 {
900 	struct bwn_dma_ring *dr;
901 	struct bwn_mac *mac = sc->sc_curmac;
902 	struct bwn_pio_txqueue *tq;
903 	int pktlen = roundup(m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
904 
905 	BWN_ASSERT_LOCKED(sc);
906 
907 	if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
908 		dr = bwn_dma_select(mac, M_WME_GETAC(m));
909 		if (dr->dr_stop == 1 ||
910 		    bwn_dma_freeslot(dr) < BWN_TX_SLOTS_PER_FRAME) {
911 			dr->dr_stop = 1;
912 			goto full;
913 		}
914 	} else {
915 		tq = bwn_pio_select(mac, M_WME_GETAC(m));
916 		if (tq->tq_free == 0 || pktlen > tq->tq_size ||
917 		    pktlen > (tq->tq_size - tq->tq_used))
918 			goto full;
919 	}
920 	return (0);
921 full:
922 	mbufq_prepend(&sc->sc_snd, m);
923 	return (1);
924 }
925 
926 static int
927 bwn_tx_start(struct bwn_softc *sc, struct ieee80211_node *ni, struct mbuf *m)
928 {
929 	struct bwn_mac *mac = sc->sc_curmac;
930 	int error;
931 
932 	BWN_ASSERT_LOCKED(sc);
933 
934 	if (m->m_pkthdr.len < IEEE80211_MIN_LEN || mac == NULL) {
935 		m_freem(m);
936 		return (ENXIO);
937 	}
938 
939 	error = (mac->mac_flags & BWN_MAC_FLAG_DMA) ?
940 	    bwn_dma_tx_start(mac, ni, m) : bwn_pio_tx_start(mac, ni, m);
941 	if (error) {
942 		m_freem(m);
943 		return (error);
944 	}
945 	return (0);
946 }
947 
948 static int
949 bwn_pio_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni, struct mbuf *m)
950 {
951 	struct bwn_pio_txpkt *tp;
952 	struct bwn_pio_txqueue *tq = bwn_pio_select(mac, M_WME_GETAC(m));
953 	struct bwn_softc *sc = mac->mac_sc;
954 	struct bwn_txhdr txhdr;
955 	struct mbuf *m_new;
956 	uint32_t ctl32;
957 	int error;
958 	uint16_t ctl16;
959 
960 	BWN_ASSERT_LOCKED(sc);
961 
962 	/* XXX TODO send packets after DTIM */
963 
964 	KASSERT(!TAILQ_EMPTY(&tq->tq_pktlist), ("%s: fail", __func__));
965 	tp = TAILQ_FIRST(&tq->tq_pktlist);
966 	tp->tp_ni = ni;
967 	tp->tp_m = m;
968 
969 	error = bwn_set_txhdr(mac, ni, m, &txhdr, BWN_PIO_COOKIE(tq, tp));
970 	if (error) {
971 		device_printf(sc->sc_dev, "tx fail\n");
972 		return (error);
973 	}
974 
975 	TAILQ_REMOVE(&tq->tq_pktlist, tp, tp_list);
976 	tq->tq_used += roundup(m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
977 	tq->tq_free--;
978 
979 	if (siba_get_revid(sc->sc_dev) >= 8) {
980 		/*
981 		 * XXX please removes m_defrag(9)
982 		 */
983 		m_new = m_defrag(m, M_NOWAIT);
984 		if (m_new == NULL) {
985 			device_printf(sc->sc_dev,
986 			    "%s: can't defrag TX buffer\n",
987 			    __func__);
988 			return (ENOBUFS);
989 		}
990 		if (m_new->m_next != NULL)
991 			device_printf(sc->sc_dev,
992 			    "TODO: fragmented packets for PIO\n");
993 		tp->tp_m = m_new;
994 
995 		/* send HEADER */
996 		ctl32 = bwn_pio_write_multi_4(mac, tq,
997 		    (BWN_PIO_READ_4(mac, tq, BWN_PIO8_TXCTL) |
998 			BWN_PIO8_TXCTL_FRAMEREADY) & ~BWN_PIO8_TXCTL_EOF,
999 		    (const uint8_t *)&txhdr, BWN_HDRSIZE(mac));
1000 		/* send BODY */
1001 		ctl32 = bwn_pio_write_multi_4(mac, tq, ctl32,
1002 		    mtod(m_new, const void *), m_new->m_pkthdr.len);
1003 		bwn_pio_write_4(mac, tq, BWN_PIO_TXCTL,
1004 		    ctl32 | BWN_PIO8_TXCTL_EOF);
1005 	} else {
1006 		ctl16 = bwn_pio_write_multi_2(mac, tq,
1007 		    (bwn_pio_read_2(mac, tq, BWN_PIO_TXCTL) |
1008 			BWN_PIO_TXCTL_FRAMEREADY) & ~BWN_PIO_TXCTL_EOF,
1009 		    (const uint8_t *)&txhdr, BWN_HDRSIZE(mac));
1010 		ctl16 = bwn_pio_write_mbuf_2(mac, tq, ctl16, m);
1011 		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL,
1012 		    ctl16 | BWN_PIO_TXCTL_EOF);
1013 	}
1014 
1015 	return (0);
1016 }
1017 
1018 static struct bwn_pio_txqueue *
1019 bwn_pio_select(struct bwn_mac *mac, uint8_t prio)
1020 {
1021 
1022 	if ((mac->mac_flags & BWN_MAC_FLAG_WME) == 0)
1023 		return (&mac->mac_method.pio.wme[WME_AC_BE]);
1024 
1025 	switch (prio) {
1026 	case 0:
1027 		return (&mac->mac_method.pio.wme[WME_AC_BE]);
1028 	case 1:
1029 		return (&mac->mac_method.pio.wme[WME_AC_BK]);
1030 	case 2:
1031 		return (&mac->mac_method.pio.wme[WME_AC_VI]);
1032 	case 3:
1033 		return (&mac->mac_method.pio.wme[WME_AC_VO]);
1034 	}
1035 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
1036 	return (NULL);
1037 }
1038 
1039 static int
1040 bwn_dma_tx_start(struct bwn_mac *mac, struct ieee80211_node *ni, struct mbuf *m)
1041 {
1042 #define	BWN_GET_TXHDRCACHE(slot)					\
1043 	&(txhdr_cache[(slot / BWN_TX_SLOTS_PER_FRAME) * BWN_HDRSIZE(mac)])
1044 	struct bwn_dma *dma = &mac->mac_method.dma;
1045 	struct bwn_dma_ring *dr = bwn_dma_select(mac, M_WME_GETAC(m));
1046 	struct bwn_dmadesc_generic *desc;
1047 	struct bwn_dmadesc_meta *mt;
1048 	struct bwn_softc *sc = mac->mac_sc;
1049 	uint8_t *txhdr_cache = (uint8_t *)dr->dr_txhdr_cache;
1050 	int error, slot, backup[2] = { dr->dr_curslot, dr->dr_usedslot };
1051 
1052 	BWN_ASSERT_LOCKED(sc);
1053 	KASSERT(!dr->dr_stop, ("%s:%d: fail", __func__, __LINE__));
1054 
1055 	/* XXX send after DTIM */
1056 
1057 	slot = bwn_dma_getslot(dr);
1058 	dr->getdesc(dr, slot, &desc, &mt);
1059 	KASSERT(mt->mt_txtype == BWN_DMADESC_METATYPE_HEADER,
1060 	    ("%s:%d: fail", __func__, __LINE__));
1061 
1062 	error = bwn_set_txhdr(dr->dr_mac, ni, m,
1063 	    (struct bwn_txhdr *)BWN_GET_TXHDRCACHE(slot),
1064 	    BWN_DMA_COOKIE(dr, slot));
1065 	if (error)
1066 		goto fail;
1067 	error = bus_dmamap_load(dr->dr_txring_dtag, mt->mt_dmap,
1068 	    BWN_GET_TXHDRCACHE(slot), BWN_HDRSIZE(mac), bwn_dma_ring_addr,
1069 	    &mt->mt_paddr, BUS_DMA_NOWAIT);
1070 	if (error) {
1071 		device_printf(sc->sc_dev, "%s: can't load TX buffer (1) %d\n",
1072 		    __func__, error);
1073 		goto fail;
1074 	}
1075 	bus_dmamap_sync(dr->dr_txring_dtag, mt->mt_dmap,
1076 	    BUS_DMASYNC_PREWRITE);
1077 	dr->setdesc(dr, desc, mt->mt_paddr, BWN_HDRSIZE(mac), 1, 0, 0);
1078 	bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
1079 	    BUS_DMASYNC_PREWRITE);
1080 
1081 	slot = bwn_dma_getslot(dr);
1082 	dr->getdesc(dr, slot, &desc, &mt);
1083 	KASSERT(mt->mt_txtype == BWN_DMADESC_METATYPE_BODY &&
1084 	    mt->mt_islast == 1, ("%s:%d: fail", __func__, __LINE__));
1085 	mt->mt_m = m;
1086 	mt->mt_ni = ni;
1087 
1088 	error = bus_dmamap_load_mbuf(dma->txbuf_dtag, mt->mt_dmap, m,
1089 	    bwn_dma_buf_addr, &mt->mt_paddr, BUS_DMA_NOWAIT);
1090 	if (error && error != EFBIG) {
1091 		device_printf(sc->sc_dev, "%s: can't load TX buffer (1) %d\n",
1092 		    __func__, error);
1093 		goto fail;
1094 	}
1095 	if (error) {    /* error == EFBIG */
1096 		struct mbuf *m_new;
1097 
1098 		m_new = m_defrag(m, M_NOWAIT);
1099 		if (m_new == NULL) {
1100 			device_printf(sc->sc_dev,
1101 			    "%s: can't defrag TX buffer\n",
1102 			    __func__);
1103 			error = ENOBUFS;
1104 			goto fail;
1105 		} else {
1106 			m = m_new;
1107 		}
1108 
1109 		mt->mt_m = m;
1110 		error = bus_dmamap_load_mbuf(dma->txbuf_dtag, mt->mt_dmap,
1111 		    m, bwn_dma_buf_addr, &mt->mt_paddr, BUS_DMA_NOWAIT);
1112 		if (error) {
1113 			device_printf(sc->sc_dev,
1114 			    "%s: can't load TX buffer (2) %d\n",
1115 			    __func__, error);
1116 			goto fail;
1117 		}
1118 	}
1119 	bus_dmamap_sync(dma->txbuf_dtag, mt->mt_dmap, BUS_DMASYNC_PREWRITE);
1120 	dr->setdesc(dr, desc, mt->mt_paddr, m->m_pkthdr.len, 0, 1, 1);
1121 	bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
1122 	    BUS_DMASYNC_PREWRITE);
1123 
1124 	/* XXX send after DTIM */
1125 
1126 	dr->start_transfer(dr, bwn_dma_nextslot(dr, slot));
1127 	return (0);
1128 fail:
1129 	dr->dr_curslot = backup[0];
1130 	dr->dr_usedslot = backup[1];
1131 	return (error);
1132 #undef BWN_GET_TXHDRCACHE
1133 }
1134 
1135 static void
1136 bwn_watchdog(void *arg)
1137 {
1138 	struct bwn_softc *sc = arg;
1139 
1140 	if (sc->sc_watchdog_timer != 0 && --sc->sc_watchdog_timer == 0) {
1141 		device_printf(sc->sc_dev, "device timeout\n");
1142 		counter_u64_add(sc->sc_ic.ic_oerrors, 1);
1143 	}
1144 	callout_schedule(&sc->sc_watchdog_ch, hz);
1145 }
1146 
1147 static int
1148 bwn_attach_core(struct bwn_mac *mac)
1149 {
1150 	struct bwn_softc *sc = mac->mac_sc;
1151 	int error, have_bg = 0, have_a = 0;
1152 
1153 	KASSERT(siba_get_revid(sc->sc_dev) >= 5,
1154 	    ("unsupported revision %d", siba_get_revid(sc->sc_dev)));
1155 
1156 	if (bwn_is_bus_siba(mac)) {
1157 		uint32_t high;
1158 
1159 		siba_powerup(sc->sc_dev, 0);
1160 		high = siba_read_4(sc->sc_dev, SIBA_TGSHIGH);
1161 		have_a = (high & BWN_TGSHIGH_HAVE_5GHZ) ? 1 : 0;
1162 		have_bg = (high & BWN_TGSHIGH_HAVE_2GHZ) ? 1 : 0;
1163 		if (high & BWN_TGSHIGH_DUALPHY) {
1164 			have_bg = 1;
1165 			have_a = 1;
1166 		}
1167 #if 0
1168 		device_printf(sc->sc_dev, "%s: high=0x%08x, have_a=%d, have_bg=%d,"
1169 		    " deviceid=0x%04x, siba_deviceid=0x%04x\n",
1170 		    __func__,
1171 		    high,
1172 		    have_a,
1173 		    have_bg,
1174 		    siba_get_pci_device(sc->sc_dev),
1175 		    siba_get_chipid(sc->sc_dev));
1176 #endif
1177 	} else {
1178 		device_printf(sc->sc_dev, "%s: not siba; bailing\n", __func__);
1179 		error = ENXIO;
1180 		goto fail;
1181 	}
1182 
1183 	/*
1184 	 * Guess at whether it has A-PHY or G-PHY.
1185 	 * This is just used for resetting the core to probe things;
1186 	 * we will re-guess once it's all up and working.
1187 	 */
1188 	bwn_reset_core(mac, have_bg);
1189 
1190 	/*
1191 	 * Get the PHY version.
1192 	 */
1193 	error = bwn_phy_getinfo(mac, have_bg);
1194 	if (error)
1195 		goto fail;
1196 
1197 	/*
1198 	 * This is the whitelist of devices which we "believe"
1199 	 * the SPROM PHY config from.  The rest are "guessed".
1200 	 */
1201 	if (siba_get_pci_device(sc->sc_dev) != 0x4312 &&
1202 	    siba_get_pci_device(sc->sc_dev) != 0x4315 &&
1203 	    siba_get_pci_device(sc->sc_dev) != 0x4319 &&
1204 	    siba_get_pci_device(sc->sc_dev) != 0x4324 &&
1205 	    siba_get_pci_device(sc->sc_dev) != 0x4328 &&
1206 	    siba_get_pci_device(sc->sc_dev) != 0x432b) {
1207 		have_a = have_bg = 0;
1208 		if (mac->mac_phy.type == BWN_PHYTYPE_A)
1209 			have_a = 1;
1210 		else if (mac->mac_phy.type == BWN_PHYTYPE_G ||
1211 		    mac->mac_phy.type == BWN_PHYTYPE_N ||
1212 		    mac->mac_phy.type == BWN_PHYTYPE_LP)
1213 			have_bg = 1;
1214 		else
1215 			KASSERT(0 == 1, ("%s: unknown phy type (%d)", __func__,
1216 			    mac->mac_phy.type));
1217 	}
1218 
1219 	/*
1220 	 * XXX The PHY-G support doesn't do 5GHz operation.
1221 	 */
1222 	if (mac->mac_phy.type != BWN_PHYTYPE_LP &&
1223 	    mac->mac_phy.type != BWN_PHYTYPE_N) {
1224 		device_printf(sc->sc_dev,
1225 		    "%s: forcing 2GHz only; no dual-band support for PHY\n",
1226 		    __func__);
1227 		have_a = 0;
1228 		have_bg = 1;
1229 	}
1230 
1231 	mac->mac_phy.phy_n = NULL;
1232 
1233 	if (mac->mac_phy.type == BWN_PHYTYPE_G) {
1234 		mac->mac_phy.attach = bwn_phy_g_attach;
1235 		mac->mac_phy.detach = bwn_phy_g_detach;
1236 		mac->mac_phy.prepare_hw = bwn_phy_g_prepare_hw;
1237 		mac->mac_phy.init_pre = bwn_phy_g_init_pre;
1238 		mac->mac_phy.init = bwn_phy_g_init;
1239 		mac->mac_phy.exit = bwn_phy_g_exit;
1240 		mac->mac_phy.phy_read = bwn_phy_g_read;
1241 		mac->mac_phy.phy_write = bwn_phy_g_write;
1242 		mac->mac_phy.rf_read = bwn_phy_g_rf_read;
1243 		mac->mac_phy.rf_write = bwn_phy_g_rf_write;
1244 		mac->mac_phy.use_hwpctl = bwn_phy_g_hwpctl;
1245 		mac->mac_phy.rf_onoff = bwn_phy_g_rf_onoff;
1246 		mac->mac_phy.switch_analog = bwn_phy_switch_analog;
1247 		mac->mac_phy.switch_channel = bwn_phy_g_switch_channel;
1248 		mac->mac_phy.get_default_chan = bwn_phy_g_get_default_chan;
1249 		mac->mac_phy.set_antenna = bwn_phy_g_set_antenna;
1250 		mac->mac_phy.set_im = bwn_phy_g_im;
1251 		mac->mac_phy.recalc_txpwr = bwn_phy_g_recalc_txpwr;
1252 		mac->mac_phy.set_txpwr = bwn_phy_g_set_txpwr;
1253 		mac->mac_phy.task_15s = bwn_phy_g_task_15s;
1254 		mac->mac_phy.task_60s = bwn_phy_g_task_60s;
1255 	} else if (mac->mac_phy.type == BWN_PHYTYPE_LP) {
1256 		mac->mac_phy.init_pre = bwn_phy_lp_init_pre;
1257 		mac->mac_phy.init = bwn_phy_lp_init;
1258 		mac->mac_phy.phy_read = bwn_phy_lp_read;
1259 		mac->mac_phy.phy_write = bwn_phy_lp_write;
1260 		mac->mac_phy.phy_maskset = bwn_phy_lp_maskset;
1261 		mac->mac_phy.rf_read = bwn_phy_lp_rf_read;
1262 		mac->mac_phy.rf_write = bwn_phy_lp_rf_write;
1263 		mac->mac_phy.rf_onoff = bwn_phy_lp_rf_onoff;
1264 		mac->mac_phy.switch_analog = bwn_phy_lp_switch_analog;
1265 		mac->mac_phy.switch_channel = bwn_phy_lp_switch_channel;
1266 		mac->mac_phy.get_default_chan = bwn_phy_lp_get_default_chan;
1267 		mac->mac_phy.set_antenna = bwn_phy_lp_set_antenna;
1268 		mac->mac_phy.task_60s = bwn_phy_lp_task_60s;
1269 	} else if (mac->mac_phy.type == BWN_PHYTYPE_N) {
1270 		mac->mac_phy.attach = bwn_phy_n_attach;
1271 		mac->mac_phy.detach = bwn_phy_n_detach;
1272 		mac->mac_phy.prepare_hw = bwn_phy_n_prepare_hw;
1273 		mac->mac_phy.init_pre = bwn_phy_n_init_pre;
1274 		mac->mac_phy.init = bwn_phy_n_init;
1275 		mac->mac_phy.exit = bwn_phy_n_exit;
1276 		mac->mac_phy.phy_read = bwn_phy_n_read;
1277 		mac->mac_phy.phy_write = bwn_phy_n_write;
1278 		mac->mac_phy.rf_read = bwn_phy_n_rf_read;
1279 		mac->mac_phy.rf_write = bwn_phy_n_rf_write;
1280 		mac->mac_phy.use_hwpctl = bwn_phy_n_hwpctl;
1281 		mac->mac_phy.rf_onoff = bwn_phy_n_rf_onoff;
1282 		mac->mac_phy.switch_analog = bwn_phy_n_switch_analog;
1283 		mac->mac_phy.switch_channel = bwn_phy_n_switch_channel;
1284 		mac->mac_phy.get_default_chan = bwn_phy_n_get_default_chan;
1285 		mac->mac_phy.set_antenna = bwn_phy_n_set_antenna;
1286 		mac->mac_phy.set_im = bwn_phy_n_im;
1287 		mac->mac_phy.recalc_txpwr = bwn_phy_n_recalc_txpwr;
1288 		mac->mac_phy.set_txpwr = bwn_phy_n_set_txpwr;
1289 		mac->mac_phy.task_15s = bwn_phy_n_task_15s;
1290 		mac->mac_phy.task_60s = bwn_phy_n_task_60s;
1291 	} else {
1292 		device_printf(sc->sc_dev, "unsupported PHY type (%d)\n",
1293 		    mac->mac_phy.type);
1294 		error = ENXIO;
1295 		goto fail;
1296 	}
1297 
1298 	mac->mac_phy.gmode = have_bg;
1299 	if (mac->mac_phy.attach != NULL) {
1300 		error = mac->mac_phy.attach(mac);
1301 		if (error) {
1302 			device_printf(sc->sc_dev, "failed\n");
1303 			goto fail;
1304 		}
1305 	}
1306 
1307 	bwn_reset_core(mac, have_bg);
1308 
1309 	error = bwn_chiptest(mac);
1310 	if (error)
1311 		goto fail;
1312 	error = bwn_setup_channels(mac, have_bg, have_a);
1313 	if (error) {
1314 		device_printf(sc->sc_dev, "failed to setup channels\n");
1315 		goto fail;
1316 	}
1317 
1318 	if (sc->sc_curmac == NULL)
1319 		sc->sc_curmac = mac;
1320 
1321 	error = bwn_dma_attach(mac);
1322 	if (error != 0) {
1323 		device_printf(sc->sc_dev, "failed to initialize DMA\n");
1324 		goto fail;
1325 	}
1326 
1327 	mac->mac_phy.switch_analog(mac, 0);
1328 
1329 	siba_dev_down(sc->sc_dev, 0);
1330 fail:
1331 	siba_powerdown(sc->sc_dev);
1332 	bwn_release_firmware(mac);
1333 	return (error);
1334 }
1335 
1336 /*
1337  * Reset - SIBA.
1338  *
1339  * XXX TODO: implement BCMA version!
1340  */
1341 void
1342 bwn_reset_core(struct bwn_mac *mac, int g_mode)
1343 {
1344 	struct bwn_softc *sc = mac->mac_sc;
1345 	uint32_t low, ctl;
1346 	uint32_t flags = 0;
1347 
1348 	DPRINTF(sc, BWN_DEBUG_RESET, "%s: g_mode=%d\n", __func__, g_mode);
1349 
1350 	flags |= (BWN_TGSLOW_PHYCLOCK_ENABLE | BWN_TGSLOW_PHYRESET);
1351 	if (g_mode)
1352 		flags |= BWN_TGSLOW_SUPPORT_G;
1353 
1354 	/* XXX N-PHY only; and hard-code to 20MHz for now */
1355 	if (mac->mac_phy.type == BWN_PHYTYPE_N)
1356 		flags |= BWN_TGSLOW_PHY_BANDWIDTH_20MHZ;
1357 
1358 	siba_dev_up(sc->sc_dev, flags);
1359 	DELAY(2000);
1360 
1361 	/* Take PHY out of reset */
1362 	low = (siba_read_4(sc->sc_dev, SIBA_TGSLOW) | SIBA_TGSLOW_FGC) &
1363 	    ~(BWN_TGSLOW_PHYRESET | BWN_TGSLOW_PHYCLOCK_ENABLE);
1364 	siba_write_4(sc->sc_dev, SIBA_TGSLOW, low);
1365 	siba_read_4(sc->sc_dev, SIBA_TGSLOW);
1366 	DELAY(2000);
1367 	low &= ~SIBA_TGSLOW_FGC;
1368 	low |= BWN_TGSLOW_PHYCLOCK_ENABLE;
1369 	siba_write_4(sc->sc_dev, SIBA_TGSLOW, low);
1370 	siba_read_4(sc->sc_dev, SIBA_TGSLOW);
1371 	DELAY(2000);
1372 
1373 	if (mac->mac_phy.switch_analog != NULL)
1374 		mac->mac_phy.switch_analog(mac, 1);
1375 
1376 	ctl = BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_GMODE;
1377 	if (g_mode)
1378 		ctl |= BWN_MACCTL_GMODE;
1379 	BWN_WRITE_4(mac, BWN_MACCTL, ctl | BWN_MACCTL_IHR_ON);
1380 }
1381 
1382 static int
1383 bwn_phy_getinfo(struct bwn_mac *mac, int gmode)
1384 {
1385 	struct bwn_phy *phy = &mac->mac_phy;
1386 	struct bwn_softc *sc = mac->mac_sc;
1387 	uint32_t tmp;
1388 
1389 	/* PHY */
1390 	tmp = BWN_READ_2(mac, BWN_PHYVER);
1391 	phy->gmode = gmode;
1392 	phy->rf_on = 1;
1393 	phy->analog = (tmp & BWN_PHYVER_ANALOG) >> 12;
1394 	phy->type = (tmp & BWN_PHYVER_TYPE) >> 8;
1395 	phy->rev = (tmp & BWN_PHYVER_VERSION);
1396 	if ((phy->type == BWN_PHYTYPE_A && phy->rev >= 4) ||
1397 	    (phy->type == BWN_PHYTYPE_B && phy->rev != 2 &&
1398 		phy->rev != 4 && phy->rev != 6 && phy->rev != 7) ||
1399 	    (phy->type == BWN_PHYTYPE_G && phy->rev > 9) ||
1400 	    (phy->type == BWN_PHYTYPE_N && phy->rev > 4) ||
1401 	    (phy->type == BWN_PHYTYPE_LP && phy->rev > 2))
1402 		goto unsupphy;
1403 
1404 	/* RADIO */
1405 	if (siba_get_chipid(sc->sc_dev) == 0x4317) {
1406 		if (siba_get_chiprev(sc->sc_dev) == 0)
1407 			tmp = 0x3205017f;
1408 		else if (siba_get_chiprev(sc->sc_dev) == 1)
1409 			tmp = 0x4205017f;
1410 		else
1411 			tmp = 0x5205017f;
1412 	} else {
1413 		BWN_WRITE_2(mac, BWN_RFCTL, BWN_RFCTL_ID);
1414 		tmp = BWN_READ_2(mac, BWN_RFDATALO);
1415 		BWN_WRITE_2(mac, BWN_RFCTL, BWN_RFCTL_ID);
1416 		tmp |= (uint32_t)BWN_READ_2(mac, BWN_RFDATAHI) << 16;
1417 	}
1418 	phy->rf_rev = (tmp & 0xf0000000) >> 28;
1419 	phy->rf_ver = (tmp & 0x0ffff000) >> 12;
1420 	phy->rf_manuf = (tmp & 0x00000fff);
1421 
1422 	/*
1423 	 * For now, just always do full init (ie, what bwn has traditionally
1424 	 * done)
1425 	 */
1426 	phy->phy_do_full_init = 1;
1427 
1428 	if (phy->rf_manuf != 0x17f)	/* 0x17f is broadcom */
1429 		goto unsupradio;
1430 	if ((phy->type == BWN_PHYTYPE_A && (phy->rf_ver != 0x2060 ||
1431 	     phy->rf_rev != 1 || phy->rf_manuf != 0x17f)) ||
1432 	    (phy->type == BWN_PHYTYPE_B && (phy->rf_ver & 0xfff0) != 0x2050) ||
1433 	    (phy->type == BWN_PHYTYPE_G && phy->rf_ver != 0x2050) ||
1434 	    (phy->type == BWN_PHYTYPE_N &&
1435 	     phy->rf_ver != 0x2055 && phy->rf_ver != 0x2056) ||
1436 	    (phy->type == BWN_PHYTYPE_LP &&
1437 	     phy->rf_ver != 0x2062 && phy->rf_ver != 0x2063))
1438 		goto unsupradio;
1439 
1440 	return (0);
1441 unsupphy:
1442 	device_printf(sc->sc_dev, "unsupported PHY (type %#x, rev %#x, "
1443 	    "analog %#x)\n",
1444 	    phy->type, phy->rev, phy->analog);
1445 	return (ENXIO);
1446 unsupradio:
1447 	device_printf(sc->sc_dev, "unsupported radio (manuf %#x, ver %#x, "
1448 	    "rev %#x)\n",
1449 	    phy->rf_manuf, phy->rf_ver, phy->rf_rev);
1450 	return (ENXIO);
1451 }
1452 
1453 static int
1454 bwn_chiptest(struct bwn_mac *mac)
1455 {
1456 #define	TESTVAL0	0x55aaaa55
1457 #define	TESTVAL1	0xaa5555aa
1458 	struct bwn_softc *sc = mac->mac_sc;
1459 	uint32_t v, backup;
1460 
1461 	BWN_LOCK(sc);
1462 
1463 	backup = bwn_shm_read_4(mac, BWN_SHARED, 0);
1464 
1465 	bwn_shm_write_4(mac, BWN_SHARED, 0, TESTVAL0);
1466 	if (bwn_shm_read_4(mac, BWN_SHARED, 0) != TESTVAL0)
1467 		goto error;
1468 	bwn_shm_write_4(mac, BWN_SHARED, 0, TESTVAL1);
1469 	if (bwn_shm_read_4(mac, BWN_SHARED, 0) != TESTVAL1)
1470 		goto error;
1471 
1472 	bwn_shm_write_4(mac, BWN_SHARED, 0, backup);
1473 
1474 	if ((siba_get_revid(sc->sc_dev) >= 3) &&
1475 	    (siba_get_revid(sc->sc_dev) <= 10)) {
1476 		BWN_WRITE_2(mac, BWN_TSF_CFP_START, 0xaaaa);
1477 		BWN_WRITE_4(mac, BWN_TSF_CFP_START, 0xccccbbbb);
1478 		if (BWN_READ_2(mac, BWN_TSF_CFP_START_LOW) != 0xbbbb)
1479 			goto error;
1480 		if (BWN_READ_2(mac, BWN_TSF_CFP_START_HIGH) != 0xcccc)
1481 			goto error;
1482 	}
1483 	BWN_WRITE_4(mac, BWN_TSF_CFP_START, 0);
1484 
1485 	v = BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_GMODE;
1486 	if (v != (BWN_MACCTL_GMODE | BWN_MACCTL_IHR_ON))
1487 		goto error;
1488 
1489 	BWN_UNLOCK(sc);
1490 	return (0);
1491 error:
1492 	BWN_UNLOCK(sc);
1493 	device_printf(sc->sc_dev, "failed to validate the chipaccess\n");
1494 	return (ENODEV);
1495 }
1496 
1497 static int
1498 bwn_setup_channels(struct bwn_mac *mac, int have_bg, int have_a)
1499 {
1500 	struct bwn_softc *sc = mac->mac_sc;
1501 	struct ieee80211com *ic = &sc->sc_ic;
1502 	uint8_t bands[IEEE80211_MODE_BYTES];
1503 
1504 	memset(ic->ic_channels, 0, sizeof(ic->ic_channels));
1505 	ic->ic_nchans = 0;
1506 
1507 	DPRINTF(sc, BWN_DEBUG_EEPROM, "%s: called; bg=%d, a=%d\n",
1508 	    __func__,
1509 	    have_bg,
1510 	    have_a);
1511 
1512 	if (have_bg) {
1513 		memset(bands, 0, sizeof(bands));
1514 		setbit(bands, IEEE80211_MODE_11B);
1515 		setbit(bands, IEEE80211_MODE_11G);
1516 		bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1517 		    &ic->ic_nchans, &bwn_chantable_bg, bands);
1518 	}
1519 
1520 	if (have_a) {
1521 		memset(bands, 0, sizeof(bands));
1522 		setbit(bands, IEEE80211_MODE_11A);
1523 		bwn_addchannels(ic->ic_channels, IEEE80211_CHAN_MAX,
1524 		    &ic->ic_nchans, &bwn_chantable_a, bands);
1525 	}
1526 
1527 	mac->mac_phy.supports_2ghz = have_bg;
1528 	mac->mac_phy.supports_5ghz = have_a;
1529 
1530 	return (ic->ic_nchans == 0 ? ENXIO : 0);
1531 }
1532 
1533 uint32_t
1534 bwn_shm_read_4(struct bwn_mac *mac, uint16_t way, uint16_t offset)
1535 {
1536 	uint32_t ret;
1537 
1538 	BWN_ASSERT_LOCKED(mac->mac_sc);
1539 
1540 	if (way == BWN_SHARED) {
1541 		KASSERT((offset & 0x0001) == 0,
1542 		    ("%s:%d warn", __func__, __LINE__));
1543 		if (offset & 0x0003) {
1544 			bwn_shm_ctlword(mac, way, offset >> 2);
1545 			ret = BWN_READ_2(mac, BWN_SHM_DATA_UNALIGNED);
1546 			ret <<= 16;
1547 			bwn_shm_ctlword(mac, way, (offset >> 2) + 1);
1548 			ret |= BWN_READ_2(mac, BWN_SHM_DATA);
1549 			goto out;
1550 		}
1551 		offset >>= 2;
1552 	}
1553 	bwn_shm_ctlword(mac, way, offset);
1554 	ret = BWN_READ_4(mac, BWN_SHM_DATA);
1555 out:
1556 	return (ret);
1557 }
1558 
1559 uint16_t
1560 bwn_shm_read_2(struct bwn_mac *mac, uint16_t way, uint16_t offset)
1561 {
1562 	uint16_t ret;
1563 
1564 	BWN_ASSERT_LOCKED(mac->mac_sc);
1565 
1566 	if (way == BWN_SHARED) {
1567 		KASSERT((offset & 0x0001) == 0,
1568 		    ("%s:%d warn", __func__, __LINE__));
1569 		if (offset & 0x0003) {
1570 			bwn_shm_ctlword(mac, way, offset >> 2);
1571 			ret = BWN_READ_2(mac, BWN_SHM_DATA_UNALIGNED);
1572 			goto out;
1573 		}
1574 		offset >>= 2;
1575 	}
1576 	bwn_shm_ctlword(mac, way, offset);
1577 	ret = BWN_READ_2(mac, BWN_SHM_DATA);
1578 out:
1579 
1580 	return (ret);
1581 }
1582 
1583 static void
1584 bwn_shm_ctlword(struct bwn_mac *mac, uint16_t way,
1585     uint16_t offset)
1586 {
1587 	uint32_t control;
1588 
1589 	control = way;
1590 	control <<= 16;
1591 	control |= offset;
1592 	BWN_WRITE_4(mac, BWN_SHM_CONTROL, control);
1593 }
1594 
1595 void
1596 bwn_shm_write_4(struct bwn_mac *mac, uint16_t way, uint16_t offset,
1597     uint32_t value)
1598 {
1599 	BWN_ASSERT_LOCKED(mac->mac_sc);
1600 
1601 	if (way == BWN_SHARED) {
1602 		KASSERT((offset & 0x0001) == 0,
1603 		    ("%s:%d warn", __func__, __LINE__));
1604 		if (offset & 0x0003) {
1605 			bwn_shm_ctlword(mac, way, offset >> 2);
1606 			BWN_WRITE_2(mac, BWN_SHM_DATA_UNALIGNED,
1607 				    (value >> 16) & 0xffff);
1608 			bwn_shm_ctlword(mac, way, (offset >> 2) + 1);
1609 			BWN_WRITE_2(mac, BWN_SHM_DATA, value & 0xffff);
1610 			return;
1611 		}
1612 		offset >>= 2;
1613 	}
1614 	bwn_shm_ctlword(mac, way, offset);
1615 	BWN_WRITE_4(mac, BWN_SHM_DATA, value);
1616 }
1617 
1618 void
1619 bwn_shm_write_2(struct bwn_mac *mac, uint16_t way, uint16_t offset,
1620     uint16_t value)
1621 {
1622 	BWN_ASSERT_LOCKED(mac->mac_sc);
1623 
1624 	if (way == BWN_SHARED) {
1625 		KASSERT((offset & 0x0001) == 0,
1626 		    ("%s:%d warn", __func__, __LINE__));
1627 		if (offset & 0x0003) {
1628 			bwn_shm_ctlword(mac, way, offset >> 2);
1629 			BWN_WRITE_2(mac, BWN_SHM_DATA_UNALIGNED, value);
1630 			return;
1631 		}
1632 		offset >>= 2;
1633 	}
1634 	bwn_shm_ctlword(mac, way, offset);
1635 	BWN_WRITE_2(mac, BWN_SHM_DATA, value);
1636 }
1637 
1638 static void
1639 bwn_addchannels(struct ieee80211_channel chans[], int maxchans, int *nchans,
1640     const struct bwn_channelinfo *ci, const uint8_t bands[])
1641 {
1642 	int i, error;
1643 
1644 	for (i = 0, error = 0; i < ci->nchannels && error == 0; i++) {
1645 		const struct bwn_channel *hc = &ci->channels[i];
1646 
1647 		error = ieee80211_add_channel(chans, maxchans, nchans,
1648 		    hc->ieee, hc->freq, hc->maxTxPow, 0, bands);
1649 	}
1650 }
1651 
1652 static int
1653 bwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
1654 	const struct ieee80211_bpf_params *params)
1655 {
1656 	struct ieee80211com *ic = ni->ni_ic;
1657 	struct bwn_softc *sc = ic->ic_softc;
1658 	struct bwn_mac *mac = sc->sc_curmac;
1659 	int error;
1660 
1661 	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0 ||
1662 	    mac->mac_status < BWN_MAC_STATUS_STARTED) {
1663 		m_freem(m);
1664 		return (ENETDOWN);
1665 	}
1666 
1667 	BWN_LOCK(sc);
1668 	if (bwn_tx_isfull(sc, m)) {
1669 		m_freem(m);
1670 		BWN_UNLOCK(sc);
1671 		return (ENOBUFS);
1672 	}
1673 
1674 	error = bwn_tx_start(sc, ni, m);
1675 	if (error == 0)
1676 		sc->sc_watchdog_timer = 5;
1677 	BWN_UNLOCK(sc);
1678 	return (error);
1679 }
1680 
1681 /*
1682  * Callback from the 802.11 layer to update the slot time
1683  * based on the current setting.  We use it to notify the
1684  * firmware of ERP changes and the f/w takes care of things
1685  * like slot time and preamble.
1686  */
1687 static void
1688 bwn_updateslot(struct ieee80211com *ic)
1689 {
1690 	struct bwn_softc *sc = ic->ic_softc;
1691 	struct bwn_mac *mac;
1692 
1693 	BWN_LOCK(sc);
1694 	if (sc->sc_flags & BWN_FLAG_RUNNING) {
1695 		mac = (struct bwn_mac *)sc->sc_curmac;
1696 		bwn_set_slot_time(mac, IEEE80211_GET_SLOTTIME(ic));
1697 	}
1698 	BWN_UNLOCK(sc);
1699 }
1700 
1701 /*
1702  * Callback from the 802.11 layer after a promiscuous mode change.
1703  * Note this interface does not check the operating mode as this
1704  * is an internal callback and we are expected to honor the current
1705  * state (e.g. this is used for setting the interface in promiscuous
1706  * mode when operating in hostap mode to do ACS).
1707  */
1708 static void
1709 bwn_update_promisc(struct ieee80211com *ic)
1710 {
1711 	struct bwn_softc *sc = ic->ic_softc;
1712 	struct bwn_mac *mac = sc->sc_curmac;
1713 
1714 	BWN_LOCK(sc);
1715 	mac = sc->sc_curmac;
1716 	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1717 		if (ic->ic_promisc > 0)
1718 			sc->sc_filters |= BWN_MACCTL_PROMISC;
1719 		else
1720 			sc->sc_filters &= ~BWN_MACCTL_PROMISC;
1721 		bwn_set_opmode(mac);
1722 	}
1723 	BWN_UNLOCK(sc);
1724 }
1725 
1726 /*
1727  * Callback from the 802.11 layer to update WME parameters.
1728  */
1729 static int
1730 bwn_wme_update(struct ieee80211com *ic)
1731 {
1732 	struct bwn_softc *sc = ic->ic_softc;
1733 	struct bwn_mac *mac = sc->sc_curmac;
1734 	struct wmeParams *wmep;
1735 	int i;
1736 
1737 	BWN_LOCK(sc);
1738 	mac = sc->sc_curmac;
1739 	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1740 		bwn_mac_suspend(mac);
1741 		for (i = 0; i < N(sc->sc_wmeParams); i++) {
1742 			wmep = &ic->ic_wme.wme_chanParams.cap_wmeParams[i];
1743 			bwn_wme_loadparams(mac, wmep, bwn_wme_shm_offsets[i]);
1744 		}
1745 		bwn_mac_enable(mac);
1746 	}
1747 	BWN_UNLOCK(sc);
1748 	return (0);
1749 }
1750 
1751 static void
1752 bwn_scan_start(struct ieee80211com *ic)
1753 {
1754 	struct bwn_softc *sc = ic->ic_softc;
1755 	struct bwn_mac *mac;
1756 
1757 	BWN_LOCK(sc);
1758 	mac = sc->sc_curmac;
1759 	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1760 		sc->sc_filters |= BWN_MACCTL_BEACON_PROMISC;
1761 		bwn_set_opmode(mac);
1762 		/* disable CFP update during scan */
1763 		bwn_hf_write(mac, bwn_hf_read(mac) | BWN_HF_SKIP_CFP_UPDATE);
1764 	}
1765 	BWN_UNLOCK(sc);
1766 }
1767 
1768 static void
1769 bwn_scan_end(struct ieee80211com *ic)
1770 {
1771 	struct bwn_softc *sc = ic->ic_softc;
1772 	struct bwn_mac *mac;
1773 
1774 	BWN_LOCK(sc);
1775 	mac = sc->sc_curmac;
1776 	if (mac != NULL && mac->mac_status >= BWN_MAC_STATUS_INITED) {
1777 		sc->sc_filters &= ~BWN_MACCTL_BEACON_PROMISC;
1778 		bwn_set_opmode(mac);
1779 		bwn_hf_write(mac, bwn_hf_read(mac) & ~BWN_HF_SKIP_CFP_UPDATE);
1780 	}
1781 	BWN_UNLOCK(sc);
1782 }
1783 
1784 static void
1785 bwn_set_channel(struct ieee80211com *ic)
1786 {
1787 	struct bwn_softc *sc = ic->ic_softc;
1788 	struct bwn_mac *mac = sc->sc_curmac;
1789 	struct bwn_phy *phy = &mac->mac_phy;
1790 	int chan, error;
1791 
1792 	BWN_LOCK(sc);
1793 
1794 	error = bwn_switch_band(sc, ic->ic_curchan);
1795 	if (error)
1796 		goto fail;
1797 	bwn_mac_suspend(mac);
1798 	bwn_set_txretry(mac, BWN_RETRY_SHORT, BWN_RETRY_LONG);
1799 	chan = ieee80211_chan2ieee(ic, ic->ic_curchan);
1800 	if (chan != phy->chan)
1801 		bwn_switch_channel(mac, chan);
1802 
1803 	/* TX power level */
1804 	if (ic->ic_curchan->ic_maxpower != 0 &&
1805 	    ic->ic_curchan->ic_maxpower != phy->txpower) {
1806 		phy->txpower = ic->ic_curchan->ic_maxpower / 2;
1807 		bwn_phy_txpower_check(mac, BWN_TXPWR_IGNORE_TIME |
1808 		    BWN_TXPWR_IGNORE_TSSI);
1809 	}
1810 
1811 	bwn_set_txantenna(mac, BWN_ANT_DEFAULT);
1812 	if (phy->set_antenna)
1813 		phy->set_antenna(mac, BWN_ANT_DEFAULT);
1814 
1815 	if (sc->sc_rf_enabled != phy->rf_on) {
1816 		if (sc->sc_rf_enabled) {
1817 			bwn_rf_turnon(mac);
1818 			if (!(mac->mac_flags & BWN_MAC_FLAG_RADIO_ON))
1819 				device_printf(sc->sc_dev,
1820 				    "please turn on the RF switch\n");
1821 		} else
1822 			bwn_rf_turnoff(mac);
1823 	}
1824 
1825 	bwn_mac_enable(mac);
1826 
1827 fail:
1828 	/*
1829 	 * Setup radio tap channel freq and flags
1830 	 */
1831 	sc->sc_tx_th.wt_chan_freq = sc->sc_rx_th.wr_chan_freq =
1832 		htole16(ic->ic_curchan->ic_freq);
1833 	sc->sc_tx_th.wt_chan_flags = sc->sc_rx_th.wr_chan_flags =
1834 		htole16(ic->ic_curchan->ic_flags & 0xffff);
1835 
1836 	BWN_UNLOCK(sc);
1837 }
1838 
1839 static struct ieee80211vap *
1840 bwn_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
1841     enum ieee80211_opmode opmode, int flags,
1842     const uint8_t bssid[IEEE80211_ADDR_LEN],
1843     const uint8_t mac[IEEE80211_ADDR_LEN])
1844 {
1845 	struct ieee80211vap *vap;
1846 	struct bwn_vap *bvp;
1847 
1848 	switch (opmode) {
1849 	case IEEE80211_M_HOSTAP:
1850 	case IEEE80211_M_MBSS:
1851 	case IEEE80211_M_STA:
1852 	case IEEE80211_M_WDS:
1853 	case IEEE80211_M_MONITOR:
1854 	case IEEE80211_M_IBSS:
1855 	case IEEE80211_M_AHDEMO:
1856 		break;
1857 	default:
1858 		return (NULL);
1859 	}
1860 
1861 	bvp = malloc(sizeof(struct bwn_vap), M_80211_VAP, M_WAITOK | M_ZERO);
1862 	vap = &bvp->bv_vap;
1863 	ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid);
1864 	/* override with driver methods */
1865 	bvp->bv_newstate = vap->iv_newstate;
1866 	vap->iv_newstate = bwn_newstate;
1867 
1868 	/* override max aid so sta's cannot assoc when we're out of sta id's */
1869 	vap->iv_max_aid = BWN_STAID_MAX;
1870 
1871 	ieee80211_ratectl_init(vap);
1872 
1873 	/* complete setup */
1874 	ieee80211_vap_attach(vap, ieee80211_media_change,
1875 	    ieee80211_media_status, mac);
1876 	return (vap);
1877 }
1878 
1879 static void
1880 bwn_vap_delete(struct ieee80211vap *vap)
1881 {
1882 	struct bwn_vap *bvp = BWN_VAP(vap);
1883 
1884 	ieee80211_ratectl_deinit(vap);
1885 	ieee80211_vap_detach(vap);
1886 	free(bvp, M_80211_VAP);
1887 }
1888 
1889 static int
1890 bwn_init(struct bwn_softc *sc)
1891 {
1892 	struct bwn_mac *mac;
1893 	int error;
1894 
1895 	BWN_ASSERT_LOCKED(sc);
1896 
1897 	DPRINTF(sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
1898 
1899 	bzero(sc->sc_bssid, IEEE80211_ADDR_LEN);
1900 	sc->sc_flags |= BWN_FLAG_NEED_BEACON_TP;
1901 	sc->sc_filters = 0;
1902 	bwn_wme_clear(sc);
1903 	sc->sc_beacons[0] = sc->sc_beacons[1] = 0;
1904 	sc->sc_rf_enabled = 1;
1905 
1906 	mac = sc->sc_curmac;
1907 	if (mac->mac_status == BWN_MAC_STATUS_UNINIT) {
1908 		error = bwn_core_init(mac);
1909 		if (error != 0)
1910 			return (error);
1911 	}
1912 	if (mac->mac_status == BWN_MAC_STATUS_INITED)
1913 		bwn_core_start(mac);
1914 
1915 	bwn_set_opmode(mac);
1916 	bwn_set_pretbtt(mac);
1917 	bwn_spu_setdelay(mac, 0);
1918 	bwn_set_macaddr(mac);
1919 
1920 	sc->sc_flags |= BWN_FLAG_RUNNING;
1921 	callout_reset(&sc->sc_rfswitch_ch, hz, bwn_rfswitch, sc);
1922 	callout_reset(&sc->sc_watchdog_ch, hz, bwn_watchdog, sc);
1923 
1924 	return (0);
1925 }
1926 
1927 static void
1928 bwn_stop(struct bwn_softc *sc)
1929 {
1930 	struct bwn_mac *mac = sc->sc_curmac;
1931 
1932 	BWN_ASSERT_LOCKED(sc);
1933 
1934 	DPRINTF(sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
1935 
1936 	if (mac->mac_status >= BWN_MAC_STATUS_INITED) {
1937 		/* XXX FIXME opmode not based on VAP */
1938 		bwn_set_opmode(mac);
1939 		bwn_set_macaddr(mac);
1940 	}
1941 
1942 	if (mac->mac_status >= BWN_MAC_STATUS_STARTED)
1943 		bwn_core_stop(mac);
1944 
1945 	callout_stop(&sc->sc_led_blink_ch);
1946 	sc->sc_led_blinking = 0;
1947 
1948 	bwn_core_exit(mac);
1949 	sc->sc_rf_enabled = 0;
1950 
1951 	sc->sc_flags &= ~BWN_FLAG_RUNNING;
1952 }
1953 
1954 static void
1955 bwn_wme_clear(struct bwn_softc *sc)
1956 {
1957 #define	MS(_v, _f)	(((_v) & _f) >> _f##_S)
1958 	struct wmeParams *p;
1959 	unsigned int i;
1960 
1961 	KASSERT(N(bwn_wme_shm_offsets) == N(sc->sc_wmeParams),
1962 	    ("%s:%d: fail", __func__, __LINE__));
1963 
1964 	for (i = 0; i < N(sc->sc_wmeParams); i++) {
1965 		p = &(sc->sc_wmeParams[i]);
1966 
1967 		switch (bwn_wme_shm_offsets[i]) {
1968 		case BWN_WME_VOICE:
1969 			p->wmep_txopLimit = 0;
1970 			p->wmep_aifsn = 2;
1971 			/* XXX FIXME: log2(cwmin) */
1972 			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1973 			p->wmep_logcwmax = MS(0x0001, WME_PARAM_LOGCWMAX);
1974 			break;
1975 		case BWN_WME_VIDEO:
1976 			p->wmep_txopLimit = 0;
1977 			p->wmep_aifsn = 2;
1978 			/* XXX FIXME: log2(cwmin) */
1979 			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1980 			p->wmep_logcwmax = MS(0x0001, WME_PARAM_LOGCWMAX);
1981 			break;
1982 		case BWN_WME_BESTEFFORT:
1983 			p->wmep_txopLimit = 0;
1984 			p->wmep_aifsn = 3;
1985 			/* XXX FIXME: log2(cwmin) */
1986 			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1987 			p->wmep_logcwmax = MS(0x03ff, WME_PARAM_LOGCWMAX);
1988 			break;
1989 		case BWN_WME_BACKGROUND:
1990 			p->wmep_txopLimit = 0;
1991 			p->wmep_aifsn = 7;
1992 			/* XXX FIXME: log2(cwmin) */
1993 			p->wmep_logcwmin = MS(0x0001, WME_PARAM_LOGCWMIN);
1994 			p->wmep_logcwmax = MS(0x03ff, WME_PARAM_LOGCWMAX);
1995 			break;
1996 		default:
1997 			KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
1998 		}
1999 	}
2000 }
2001 
2002 static int
2003 bwn_core_init(struct bwn_mac *mac)
2004 {
2005 	struct bwn_softc *sc = mac->mac_sc;
2006 	uint64_t hf;
2007 	int error;
2008 
2009 	KASSERT(mac->mac_status == BWN_MAC_STATUS_UNINIT,
2010 	    ("%s:%d: fail", __func__, __LINE__));
2011 
2012 	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
2013 
2014 	siba_powerup(sc->sc_dev, 0);
2015 	if (!siba_dev_isup(sc->sc_dev))
2016 		bwn_reset_core(mac, mac->mac_phy.gmode);
2017 
2018 	mac->mac_flags &= ~BWN_MAC_FLAG_DFQVALID;
2019 	mac->mac_flags |= BWN_MAC_FLAG_RADIO_ON;
2020 	mac->mac_phy.hwpctl = (bwn_hwpctl) ? 1 : 0;
2021 	BWN_GETTIME(mac->mac_phy.nexttime);
2022 	mac->mac_phy.txerrors = BWN_TXERROR_MAX;
2023 	bzero(&mac->mac_stats, sizeof(mac->mac_stats));
2024 	mac->mac_stats.link_noise = -95;
2025 	mac->mac_reason_intr = 0;
2026 	bzero(mac->mac_reason, sizeof(mac->mac_reason));
2027 	mac->mac_intr_mask = BWN_INTR_MASKTEMPLATE;
2028 #ifdef BWN_DEBUG
2029 	if (sc->sc_debug & BWN_DEBUG_XMIT)
2030 		mac->mac_intr_mask &= ~BWN_INTR_PHY_TXERR;
2031 #endif
2032 	mac->mac_suspended = 1;
2033 	mac->mac_task_state = 0;
2034 	memset(&mac->mac_noise, 0, sizeof(mac->mac_noise));
2035 
2036 	mac->mac_phy.init_pre(mac);
2037 
2038 	siba_pcicore_intr(sc->sc_dev);
2039 
2040 	siba_fix_imcfglobug(sc->sc_dev);
2041 	bwn_bt_disable(mac);
2042 	if (mac->mac_phy.prepare_hw) {
2043 		error = mac->mac_phy.prepare_hw(mac);
2044 		if (error)
2045 			goto fail0;
2046 	}
2047 	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: chip_init\n", __func__);
2048 	error = bwn_chip_init(mac);
2049 	if (error)
2050 		goto fail0;
2051 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_COREREV,
2052 	    siba_get_revid(sc->sc_dev));
2053 	hf = bwn_hf_read(mac);
2054 	if (mac->mac_phy.type == BWN_PHYTYPE_G) {
2055 		hf |= BWN_HF_GPHY_SYM_WORKAROUND;
2056 		if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_PACTRL)
2057 			hf |= BWN_HF_PAGAINBOOST_OFDM_ON;
2058 		if (mac->mac_phy.rev == 1)
2059 			hf |= BWN_HF_GPHY_DC_CANCELFILTER;
2060 	}
2061 	if (mac->mac_phy.rf_ver == 0x2050) {
2062 		if (mac->mac_phy.rf_rev < 6)
2063 			hf |= BWN_HF_FORCE_VCO_RECALC;
2064 		if (mac->mac_phy.rf_rev == 6)
2065 			hf |= BWN_HF_4318_TSSI;
2066 	}
2067 	if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_CRYSTAL_NOSLOW)
2068 		hf |= BWN_HF_SLOWCLOCK_REQ_OFF;
2069 	if ((siba_get_type(sc->sc_dev) == SIBA_TYPE_PCI) &&
2070 	    (siba_get_pcicore_revid(sc->sc_dev) <= 10))
2071 		hf |= BWN_HF_PCI_SLOWCLOCK_WORKAROUND;
2072 	hf &= ~BWN_HF_SKIP_CFP_UPDATE;
2073 	bwn_hf_write(mac, hf);
2074 
2075 	/* Tell the firmware about the MAC capabilities */
2076 	if (siba_get_revid(sc->sc_dev) >= 13) {
2077 		uint32_t cap;
2078 		cap = BWN_READ_4(mac, BWN_MAC_HW_CAP);
2079 		DPRINTF(sc, BWN_DEBUG_RESET,
2080 		    "%s: hw capabilities: 0x%08x\n",
2081 		    __func__, cap);
2082 		bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_MACHW_L,
2083 		    cap & 0xffff);
2084 		bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_MACHW_H,
2085 		    (cap >> 16) & 0xffff);
2086 	}
2087 
2088 	bwn_set_txretry(mac, BWN_RETRY_SHORT, BWN_RETRY_LONG);
2089 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_SHORT_RETRY_FALLBACK, 3);
2090 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_LONG_RETRY_FALLBACK, 2);
2091 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_MAXTIME, 1);
2092 
2093 	bwn_rate_init(mac);
2094 	bwn_set_phytxctl(mac);
2095 
2096 	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_CONT_MIN,
2097 	    (mac->mac_phy.type == BWN_PHYTYPE_B) ? 0x1f : 0xf);
2098 	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_CONT_MAX, 0x3ff);
2099 
2100 	if (siba_get_type(sc->sc_dev) == SIBA_TYPE_PCMCIA || bwn_usedma == 0)
2101 		bwn_pio_init(mac);
2102 	else
2103 		bwn_dma_init(mac);
2104 	bwn_wme_init(mac);
2105 	bwn_spu_setdelay(mac, 1);
2106 	bwn_bt_enable(mac);
2107 
2108 	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: powerup\n", __func__);
2109 	siba_powerup(sc->sc_dev,
2110 	    !(siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_CRYSTAL_NOSLOW));
2111 	bwn_set_macaddr(mac);
2112 	bwn_crypt_init(mac);
2113 
2114 	/* XXX LED initializatin */
2115 
2116 	mac->mac_status = BWN_MAC_STATUS_INITED;
2117 
2118 	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: done\n", __func__);
2119 	return (error);
2120 
2121 fail0:
2122 	siba_powerdown(sc->sc_dev);
2123 	KASSERT(mac->mac_status == BWN_MAC_STATUS_UNINIT,
2124 	    ("%s:%d: fail", __func__, __LINE__));
2125 	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: fail\n", __func__);
2126 	return (error);
2127 }
2128 
2129 static void
2130 bwn_core_start(struct bwn_mac *mac)
2131 {
2132 	struct bwn_softc *sc = mac->mac_sc;
2133 	uint32_t tmp;
2134 
2135 	KASSERT(mac->mac_status == BWN_MAC_STATUS_INITED,
2136 	    ("%s:%d: fail", __func__, __LINE__));
2137 
2138 	if (siba_get_revid(sc->sc_dev) < 5)
2139 		return;
2140 
2141 	while (1) {
2142 		tmp = BWN_READ_4(mac, BWN_XMITSTAT_0);
2143 		if (!(tmp & 0x00000001))
2144 			break;
2145 		tmp = BWN_READ_4(mac, BWN_XMITSTAT_1);
2146 	}
2147 
2148 	bwn_mac_enable(mac);
2149 	BWN_WRITE_4(mac, BWN_INTR_MASK, mac->mac_intr_mask);
2150 	callout_reset(&sc->sc_task_ch, hz * 15, bwn_tasks, mac);
2151 
2152 	mac->mac_status = BWN_MAC_STATUS_STARTED;
2153 }
2154 
2155 static void
2156 bwn_core_exit(struct bwn_mac *mac)
2157 {
2158 	struct bwn_softc *sc = mac->mac_sc;
2159 	uint32_t macctl;
2160 
2161 	BWN_ASSERT_LOCKED(mac->mac_sc);
2162 
2163 	KASSERT(mac->mac_status <= BWN_MAC_STATUS_INITED,
2164 	    ("%s:%d: fail", __func__, __LINE__));
2165 
2166 	if (mac->mac_status != BWN_MAC_STATUS_INITED)
2167 		return;
2168 	mac->mac_status = BWN_MAC_STATUS_UNINIT;
2169 
2170 	macctl = BWN_READ_4(mac, BWN_MACCTL);
2171 	macctl &= ~BWN_MACCTL_MCODE_RUN;
2172 	macctl |= BWN_MACCTL_MCODE_JMP0;
2173 	BWN_WRITE_4(mac, BWN_MACCTL, macctl);
2174 
2175 	bwn_dma_stop(mac);
2176 	bwn_pio_stop(mac);
2177 	bwn_chip_exit(mac);
2178 	mac->mac_phy.switch_analog(mac, 0);
2179 	siba_dev_down(sc->sc_dev, 0);
2180 	siba_powerdown(sc->sc_dev);
2181 }
2182 
2183 static void
2184 bwn_bt_disable(struct bwn_mac *mac)
2185 {
2186 	struct bwn_softc *sc = mac->mac_sc;
2187 
2188 	(void)sc;
2189 	/* XXX do nothing yet */
2190 }
2191 
2192 static int
2193 bwn_chip_init(struct bwn_mac *mac)
2194 {
2195 	struct bwn_softc *sc = mac->mac_sc;
2196 	struct bwn_phy *phy = &mac->mac_phy;
2197 	uint32_t macctl;
2198 	int error;
2199 
2200 	macctl = BWN_MACCTL_IHR_ON | BWN_MACCTL_SHM_ON | BWN_MACCTL_STA;
2201 	if (phy->gmode)
2202 		macctl |= BWN_MACCTL_GMODE;
2203 	BWN_WRITE_4(mac, BWN_MACCTL, macctl);
2204 
2205 	error = bwn_fw_fillinfo(mac);
2206 	if (error)
2207 		return (error);
2208 	error = bwn_fw_loaducode(mac);
2209 	if (error)
2210 		return (error);
2211 
2212 	error = bwn_gpio_init(mac);
2213 	if (error)
2214 		return (error);
2215 
2216 	error = bwn_fw_loadinitvals(mac);
2217 	if (error) {
2218 		siba_gpio_set(sc->sc_dev, 0);
2219 		return (error);
2220 	}
2221 	phy->switch_analog(mac, 1);
2222 	error = bwn_phy_init(mac);
2223 	if (error) {
2224 		siba_gpio_set(sc->sc_dev, 0);
2225 		return (error);
2226 	}
2227 	if (phy->set_im)
2228 		phy->set_im(mac, BWN_IMMODE_NONE);
2229 	if (phy->set_antenna)
2230 		phy->set_antenna(mac, BWN_ANT_DEFAULT);
2231 	bwn_set_txantenna(mac, BWN_ANT_DEFAULT);
2232 
2233 	if (phy->type == BWN_PHYTYPE_B)
2234 		BWN_WRITE_2(mac, 0x005e, BWN_READ_2(mac, 0x005e) | 0x0004);
2235 	BWN_WRITE_4(mac, 0x0100, 0x01000000);
2236 	if (siba_get_revid(sc->sc_dev) < 5)
2237 		BWN_WRITE_4(mac, 0x010c, 0x01000000);
2238 
2239 	BWN_WRITE_4(mac, BWN_MACCTL,
2240 	    BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_STA);
2241 	BWN_WRITE_4(mac, BWN_MACCTL,
2242 	    BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_STA);
2243 	bwn_shm_write_2(mac, BWN_SHARED, 0x0074, 0x0000);
2244 
2245 	bwn_set_opmode(mac);
2246 	if (siba_get_revid(sc->sc_dev) < 3) {
2247 		BWN_WRITE_2(mac, 0x060e, 0x0000);
2248 		BWN_WRITE_2(mac, 0x0610, 0x8000);
2249 		BWN_WRITE_2(mac, 0x0604, 0x0000);
2250 		BWN_WRITE_2(mac, 0x0606, 0x0200);
2251 	} else {
2252 		BWN_WRITE_4(mac, 0x0188, 0x80000000);
2253 		BWN_WRITE_4(mac, 0x018c, 0x02000000);
2254 	}
2255 	BWN_WRITE_4(mac, BWN_INTR_REASON, 0x00004000);
2256 	BWN_WRITE_4(mac, BWN_DMA0_INTR_MASK, 0x0001dc00);
2257 	BWN_WRITE_4(mac, BWN_DMA1_INTR_MASK, 0x0000dc00);
2258 	BWN_WRITE_4(mac, BWN_DMA2_INTR_MASK, 0x0000dc00);
2259 	BWN_WRITE_4(mac, BWN_DMA3_INTR_MASK, 0x0001dc00);
2260 	BWN_WRITE_4(mac, BWN_DMA4_INTR_MASK, 0x0000dc00);
2261 	BWN_WRITE_4(mac, BWN_DMA5_INTR_MASK, 0x0000dc00);
2262 
2263 	bwn_mac_phy_clock_set(mac, true);
2264 
2265 	/* SIBA powerup */
2266 	/* XXX TODO: BCMA powerup */
2267 	BWN_WRITE_2(mac, BWN_POWERUP_DELAY, siba_get_cc_powerdelay(sc->sc_dev));
2268 	return (error);
2269 }
2270 
2271 /* read hostflags */
2272 uint64_t
2273 bwn_hf_read(struct bwn_mac *mac)
2274 {
2275 	uint64_t ret;
2276 
2277 	ret = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFHI);
2278 	ret <<= 16;
2279 	ret |= bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFMI);
2280 	ret <<= 16;
2281 	ret |= bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_HFLO);
2282 	return (ret);
2283 }
2284 
2285 void
2286 bwn_hf_write(struct bwn_mac *mac, uint64_t value)
2287 {
2288 
2289 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFLO,
2290 	    (value & 0x00000000ffffull));
2291 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFMI,
2292 	    (value & 0x0000ffff0000ull) >> 16);
2293 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_HFHI,
2294 	    (value & 0xffff00000000ULL) >> 32);
2295 }
2296 
2297 static void
2298 bwn_set_txretry(struct bwn_mac *mac, int s, int l)
2299 {
2300 
2301 	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_SHORT_RETRY, MIN(s, 0xf));
2302 	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_SCRATCH_LONG_RETRY, MIN(l, 0xf));
2303 }
2304 
2305 static void
2306 bwn_rate_init(struct bwn_mac *mac)
2307 {
2308 
2309 	switch (mac->mac_phy.type) {
2310 	case BWN_PHYTYPE_A:
2311 	case BWN_PHYTYPE_G:
2312 	case BWN_PHYTYPE_LP:
2313 	case BWN_PHYTYPE_N:
2314 		bwn_rate_write(mac, BWN_OFDM_RATE_6MB, 1);
2315 		bwn_rate_write(mac, BWN_OFDM_RATE_12MB, 1);
2316 		bwn_rate_write(mac, BWN_OFDM_RATE_18MB, 1);
2317 		bwn_rate_write(mac, BWN_OFDM_RATE_24MB, 1);
2318 		bwn_rate_write(mac, BWN_OFDM_RATE_36MB, 1);
2319 		bwn_rate_write(mac, BWN_OFDM_RATE_48MB, 1);
2320 		bwn_rate_write(mac, BWN_OFDM_RATE_54MB, 1);
2321 		if (mac->mac_phy.type == BWN_PHYTYPE_A)
2322 			break;
2323 		/* FALLTHROUGH */
2324 	case BWN_PHYTYPE_B:
2325 		bwn_rate_write(mac, BWN_CCK_RATE_1MB, 0);
2326 		bwn_rate_write(mac, BWN_CCK_RATE_2MB, 0);
2327 		bwn_rate_write(mac, BWN_CCK_RATE_5MB, 0);
2328 		bwn_rate_write(mac, BWN_CCK_RATE_11MB, 0);
2329 		break;
2330 	default:
2331 		KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2332 	}
2333 }
2334 
2335 static void
2336 bwn_rate_write(struct bwn_mac *mac, uint16_t rate, int ofdm)
2337 {
2338 	uint16_t offset;
2339 
2340 	if (ofdm) {
2341 		offset = 0x480;
2342 		offset += (bwn_plcp_getofdm(rate) & 0x000f) * 2;
2343 	} else {
2344 		offset = 0x4c0;
2345 		offset += (bwn_plcp_getcck(rate) & 0x000f) * 2;
2346 	}
2347 	bwn_shm_write_2(mac, BWN_SHARED, offset + 0x20,
2348 	    bwn_shm_read_2(mac, BWN_SHARED, offset));
2349 }
2350 
2351 static uint8_t
2352 bwn_plcp_getcck(const uint8_t bitrate)
2353 {
2354 
2355 	switch (bitrate) {
2356 	case BWN_CCK_RATE_1MB:
2357 		return (0x0a);
2358 	case BWN_CCK_RATE_2MB:
2359 		return (0x14);
2360 	case BWN_CCK_RATE_5MB:
2361 		return (0x37);
2362 	case BWN_CCK_RATE_11MB:
2363 		return (0x6e);
2364 	}
2365 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2366 	return (0);
2367 }
2368 
2369 static uint8_t
2370 bwn_plcp_getofdm(const uint8_t bitrate)
2371 {
2372 
2373 	switch (bitrate) {
2374 	case BWN_OFDM_RATE_6MB:
2375 		return (0xb);
2376 	case BWN_OFDM_RATE_9MB:
2377 		return (0xf);
2378 	case BWN_OFDM_RATE_12MB:
2379 		return (0xa);
2380 	case BWN_OFDM_RATE_18MB:
2381 		return (0xe);
2382 	case BWN_OFDM_RATE_24MB:
2383 		return (0x9);
2384 	case BWN_OFDM_RATE_36MB:
2385 		return (0xd);
2386 	case BWN_OFDM_RATE_48MB:
2387 		return (0x8);
2388 	case BWN_OFDM_RATE_54MB:
2389 		return (0xc);
2390 	}
2391 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2392 	return (0);
2393 }
2394 
2395 static void
2396 bwn_set_phytxctl(struct bwn_mac *mac)
2397 {
2398 	uint16_t ctl;
2399 
2400 	ctl = (BWN_TX_PHY_ENC_CCK | BWN_TX_PHY_ANT01AUTO |
2401 	    BWN_TX_PHY_TXPWR);
2402 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_BEACON_PHYCTL, ctl);
2403 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL, ctl);
2404 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL, ctl);
2405 }
2406 
2407 static void
2408 bwn_pio_init(struct bwn_mac *mac)
2409 {
2410 	struct bwn_pio *pio = &mac->mac_method.pio;
2411 
2412 	BWN_WRITE_4(mac, BWN_MACCTL, BWN_READ_4(mac, BWN_MACCTL)
2413 	    & ~BWN_MACCTL_BIGENDIAN);
2414 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_RX_PADOFFSET, 0);
2415 
2416 	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_BK], 0);
2417 	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_BE], 1);
2418 	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_VI], 2);
2419 	bwn_pio_set_txqueue(mac, &pio->wme[WME_AC_VO], 3);
2420 	bwn_pio_set_txqueue(mac, &pio->mcast, 4);
2421 	bwn_pio_setupqueue_rx(mac, &pio->rx, 0);
2422 }
2423 
2424 static void
2425 bwn_pio_set_txqueue(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
2426     int index)
2427 {
2428 	struct bwn_pio_txpkt *tp;
2429 	struct bwn_softc *sc = mac->mac_sc;
2430 	unsigned int i;
2431 
2432 	tq->tq_base = bwn_pio_idx2base(mac, index) + BWN_PIO_TXQOFFSET(mac);
2433 	tq->tq_index = index;
2434 
2435 	tq->tq_free = BWN_PIO_MAX_TXPACKETS;
2436 	if (siba_get_revid(sc->sc_dev) >= 8)
2437 		tq->tq_size = 1920;
2438 	else {
2439 		tq->tq_size = bwn_pio_read_2(mac, tq, BWN_PIO_TXQBUFSIZE);
2440 		tq->tq_size -= 80;
2441 	}
2442 
2443 	TAILQ_INIT(&tq->tq_pktlist);
2444 	for (i = 0; i < N(tq->tq_pkts); i++) {
2445 		tp = &(tq->tq_pkts[i]);
2446 		tp->tp_index = i;
2447 		tp->tp_queue = tq;
2448 		TAILQ_INSERT_TAIL(&tq->tq_pktlist, tp, tp_list);
2449 	}
2450 }
2451 
2452 static uint16_t
2453 bwn_pio_idx2base(struct bwn_mac *mac, int index)
2454 {
2455 	struct bwn_softc *sc = mac->mac_sc;
2456 	static const uint16_t bases[] = {
2457 		BWN_PIO_BASE0,
2458 		BWN_PIO_BASE1,
2459 		BWN_PIO_BASE2,
2460 		BWN_PIO_BASE3,
2461 		BWN_PIO_BASE4,
2462 		BWN_PIO_BASE5,
2463 		BWN_PIO_BASE6,
2464 		BWN_PIO_BASE7,
2465 	};
2466 	static const uint16_t bases_rev11[] = {
2467 		BWN_PIO11_BASE0,
2468 		BWN_PIO11_BASE1,
2469 		BWN_PIO11_BASE2,
2470 		BWN_PIO11_BASE3,
2471 		BWN_PIO11_BASE4,
2472 		BWN_PIO11_BASE5,
2473 	};
2474 
2475 	if (siba_get_revid(sc->sc_dev) >= 11) {
2476 		if (index >= N(bases_rev11))
2477 			device_printf(sc->sc_dev, "%s: warning\n", __func__);
2478 		return (bases_rev11[index]);
2479 	}
2480 	if (index >= N(bases))
2481 		device_printf(sc->sc_dev, "%s: warning\n", __func__);
2482 	return (bases[index]);
2483 }
2484 
2485 static void
2486 bwn_pio_setupqueue_rx(struct bwn_mac *mac, struct bwn_pio_rxqueue *prq,
2487     int index)
2488 {
2489 	struct bwn_softc *sc = mac->mac_sc;
2490 
2491 	prq->prq_mac = mac;
2492 	prq->prq_rev = siba_get_revid(sc->sc_dev);
2493 	prq->prq_base = bwn_pio_idx2base(mac, index) + BWN_PIO_RXQOFFSET(mac);
2494 	bwn_dma_rxdirectfifo(mac, index, 1);
2495 }
2496 
2497 static void
2498 bwn_destroy_pioqueue_tx(struct bwn_pio_txqueue *tq)
2499 {
2500 	if (tq == NULL)
2501 		return;
2502 	bwn_pio_cancel_tx_packets(tq);
2503 }
2504 
2505 static void
2506 bwn_destroy_queue_tx(struct bwn_pio_txqueue *pio)
2507 {
2508 
2509 	bwn_destroy_pioqueue_tx(pio);
2510 }
2511 
2512 static uint16_t
2513 bwn_pio_read_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
2514     uint16_t offset)
2515 {
2516 
2517 	return (BWN_READ_2(mac, tq->tq_base + offset));
2518 }
2519 
2520 static void
2521 bwn_dma_rxdirectfifo(struct bwn_mac *mac, int idx, uint8_t enable)
2522 {
2523 	uint32_t ctl;
2524 	int type;
2525 	uint16_t base;
2526 
2527 	type = bwn_dma_mask2type(bwn_dma_mask(mac));
2528 	base = bwn_dma_base(type, idx);
2529 	if (type == BWN_DMA_64BIT) {
2530 		ctl = BWN_READ_4(mac, base + BWN_DMA64_RXCTL);
2531 		ctl &= ~BWN_DMA64_RXDIRECTFIFO;
2532 		if (enable)
2533 			ctl |= BWN_DMA64_RXDIRECTFIFO;
2534 		BWN_WRITE_4(mac, base + BWN_DMA64_RXCTL, ctl);
2535 	} else {
2536 		ctl = BWN_READ_4(mac, base + BWN_DMA32_RXCTL);
2537 		ctl &= ~BWN_DMA32_RXDIRECTFIFO;
2538 		if (enable)
2539 			ctl |= BWN_DMA32_RXDIRECTFIFO;
2540 		BWN_WRITE_4(mac, base + BWN_DMA32_RXCTL, ctl);
2541 	}
2542 }
2543 
2544 static uint64_t
2545 bwn_dma_mask(struct bwn_mac *mac)
2546 {
2547 	uint32_t tmp;
2548 	uint16_t base;
2549 
2550 	tmp = BWN_READ_4(mac, SIBA_TGSHIGH);
2551 	if (tmp & SIBA_TGSHIGH_DMA64)
2552 		return (BWN_DMA_BIT_MASK(64));
2553 	base = bwn_dma_base(0, 0);
2554 	BWN_WRITE_4(mac, base + BWN_DMA32_TXCTL, BWN_DMA32_TXADDREXT_MASK);
2555 	tmp = BWN_READ_4(mac, base + BWN_DMA32_TXCTL);
2556 	if (tmp & BWN_DMA32_TXADDREXT_MASK)
2557 		return (BWN_DMA_BIT_MASK(32));
2558 
2559 	return (BWN_DMA_BIT_MASK(30));
2560 }
2561 
2562 static int
2563 bwn_dma_mask2type(uint64_t dmamask)
2564 {
2565 
2566 	if (dmamask == BWN_DMA_BIT_MASK(30))
2567 		return (BWN_DMA_30BIT);
2568 	if (dmamask == BWN_DMA_BIT_MASK(32))
2569 		return (BWN_DMA_32BIT);
2570 	if (dmamask == BWN_DMA_BIT_MASK(64))
2571 		return (BWN_DMA_64BIT);
2572 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2573 	return (BWN_DMA_30BIT);
2574 }
2575 
2576 static void
2577 bwn_pio_cancel_tx_packets(struct bwn_pio_txqueue *tq)
2578 {
2579 	struct bwn_pio_txpkt *tp;
2580 	unsigned int i;
2581 
2582 	for (i = 0; i < N(tq->tq_pkts); i++) {
2583 		tp = &(tq->tq_pkts[i]);
2584 		if (tp->tp_m) {
2585 			m_freem(tp->tp_m);
2586 			tp->tp_m = NULL;
2587 		}
2588 	}
2589 }
2590 
2591 static uint16_t
2592 bwn_dma_base(int type, int controller_idx)
2593 {
2594 	static const uint16_t map64[] = {
2595 		BWN_DMA64_BASE0,
2596 		BWN_DMA64_BASE1,
2597 		BWN_DMA64_BASE2,
2598 		BWN_DMA64_BASE3,
2599 		BWN_DMA64_BASE4,
2600 		BWN_DMA64_BASE5,
2601 	};
2602 	static const uint16_t map32[] = {
2603 		BWN_DMA32_BASE0,
2604 		BWN_DMA32_BASE1,
2605 		BWN_DMA32_BASE2,
2606 		BWN_DMA32_BASE3,
2607 		BWN_DMA32_BASE4,
2608 		BWN_DMA32_BASE5,
2609 	};
2610 
2611 	if (type == BWN_DMA_64BIT) {
2612 		KASSERT(controller_idx >= 0 && controller_idx < N(map64),
2613 		    ("%s:%d: fail", __func__, __LINE__));
2614 		return (map64[controller_idx]);
2615 	}
2616 	KASSERT(controller_idx >= 0 && controller_idx < N(map32),
2617 	    ("%s:%d: fail", __func__, __LINE__));
2618 	return (map32[controller_idx]);
2619 }
2620 
2621 static void
2622 bwn_dma_init(struct bwn_mac *mac)
2623 {
2624 	struct bwn_dma *dma = &mac->mac_method.dma;
2625 
2626 	/* setup TX DMA channels. */
2627 	bwn_dma_setup(dma->wme[WME_AC_BK]);
2628 	bwn_dma_setup(dma->wme[WME_AC_BE]);
2629 	bwn_dma_setup(dma->wme[WME_AC_VI]);
2630 	bwn_dma_setup(dma->wme[WME_AC_VO]);
2631 	bwn_dma_setup(dma->mcast);
2632 	/* setup RX DMA channel. */
2633 	bwn_dma_setup(dma->rx);
2634 }
2635 
2636 static struct bwn_dma_ring *
2637 bwn_dma_ringsetup(struct bwn_mac *mac, int controller_index,
2638     int for_tx, int type)
2639 {
2640 	struct bwn_dma *dma = &mac->mac_method.dma;
2641 	struct bwn_dma_ring *dr;
2642 	struct bwn_dmadesc_generic *desc;
2643 	struct bwn_dmadesc_meta *mt;
2644 	struct bwn_softc *sc = mac->mac_sc;
2645 	int error, i;
2646 
2647 	dr = malloc(sizeof(*dr), M_DEVBUF, M_NOWAIT | M_ZERO);
2648 	if (dr == NULL)
2649 		goto out;
2650 	dr->dr_numslots = BWN_RXRING_SLOTS;
2651 	if (for_tx)
2652 		dr->dr_numslots = BWN_TXRING_SLOTS;
2653 
2654 	dr->dr_meta = malloc(dr->dr_numslots * sizeof(struct bwn_dmadesc_meta),
2655 	    M_DEVBUF, M_NOWAIT | M_ZERO);
2656 	if (dr->dr_meta == NULL)
2657 		goto fail0;
2658 
2659 	dr->dr_type = type;
2660 	dr->dr_mac = mac;
2661 	dr->dr_base = bwn_dma_base(type, controller_index);
2662 	dr->dr_index = controller_index;
2663 	if (type == BWN_DMA_64BIT) {
2664 		dr->getdesc = bwn_dma_64_getdesc;
2665 		dr->setdesc = bwn_dma_64_setdesc;
2666 		dr->start_transfer = bwn_dma_64_start_transfer;
2667 		dr->suspend = bwn_dma_64_suspend;
2668 		dr->resume = bwn_dma_64_resume;
2669 		dr->get_curslot = bwn_dma_64_get_curslot;
2670 		dr->set_curslot = bwn_dma_64_set_curslot;
2671 	} else {
2672 		dr->getdesc = bwn_dma_32_getdesc;
2673 		dr->setdesc = bwn_dma_32_setdesc;
2674 		dr->start_transfer = bwn_dma_32_start_transfer;
2675 		dr->suspend = bwn_dma_32_suspend;
2676 		dr->resume = bwn_dma_32_resume;
2677 		dr->get_curslot = bwn_dma_32_get_curslot;
2678 		dr->set_curslot = bwn_dma_32_set_curslot;
2679 	}
2680 	if (for_tx) {
2681 		dr->dr_tx = 1;
2682 		dr->dr_curslot = -1;
2683 	} else {
2684 		if (dr->dr_index == 0) {
2685 			switch (mac->mac_fw.fw_hdr_format) {
2686 			case BWN_FW_HDR_351:
2687 			case BWN_FW_HDR_410:
2688 				dr->dr_rx_bufsize =
2689 				    BWN_DMA0_RX_BUFFERSIZE_FW351;
2690 				dr->dr_frameoffset =
2691 				    BWN_DMA0_RX_FRAMEOFFSET_FW351;
2692 				break;
2693 			case BWN_FW_HDR_598:
2694 				dr->dr_rx_bufsize =
2695 				    BWN_DMA0_RX_BUFFERSIZE_FW598;
2696 				dr->dr_frameoffset =
2697 				    BWN_DMA0_RX_FRAMEOFFSET_FW598;
2698 				break;
2699 			}
2700 		} else
2701 			KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
2702 	}
2703 
2704 	error = bwn_dma_allocringmemory(dr);
2705 	if (error)
2706 		goto fail2;
2707 
2708 	if (for_tx) {
2709 		/*
2710 		 * Assumption: BWN_TXRING_SLOTS can be divided by
2711 		 * BWN_TX_SLOTS_PER_FRAME
2712 		 */
2713 		KASSERT(BWN_TXRING_SLOTS % BWN_TX_SLOTS_PER_FRAME == 0,
2714 		    ("%s:%d: fail", __func__, __LINE__));
2715 
2716 		dr->dr_txhdr_cache = contigmalloc(
2717 		    (dr->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2718 		    BWN_MAXTXHDRSIZE, M_DEVBUF, M_ZERO,
2719 		    0, BUS_SPACE_MAXADDR, 8, 0);
2720 		if (dr->dr_txhdr_cache == NULL) {
2721 			device_printf(sc->sc_dev,
2722 			    "can't allocate TX header DMA memory\n");
2723 			goto fail1;
2724 		}
2725 
2726 		/*
2727 		 * Create TX ring DMA stuffs
2728 		 */
2729 		error = bus_dma_tag_create(dma->parent_dtag,
2730 				    BWN_ALIGN, 0,
2731 				    BUS_SPACE_MAXADDR,
2732 				    BUS_SPACE_MAXADDR,
2733 				    NULL, NULL,
2734 				    BWN_HDRSIZE(mac),
2735 				    1,
2736 				    BUS_SPACE_MAXSIZE_32BIT,
2737 				    0,
2738 				    NULL, NULL,
2739 				    &dr->dr_txring_dtag);
2740 		if (error) {
2741 			device_printf(sc->sc_dev,
2742 			    "can't create TX ring DMA tag: TODO frees\n");
2743 			goto fail2;
2744 		}
2745 
2746 		for (i = 0; i < dr->dr_numslots; i += 2) {
2747 			dr->getdesc(dr, i, &desc, &mt);
2748 
2749 			mt->mt_txtype = BWN_DMADESC_METATYPE_HEADER;
2750 			mt->mt_m = NULL;
2751 			mt->mt_ni = NULL;
2752 			mt->mt_islast = 0;
2753 			error = bus_dmamap_create(dr->dr_txring_dtag, 0,
2754 			    &mt->mt_dmap);
2755 			if (error) {
2756 				device_printf(sc->sc_dev,
2757 				     "can't create RX buf DMA map\n");
2758 				goto fail2;
2759 			}
2760 
2761 			dr->getdesc(dr, i + 1, &desc, &mt);
2762 
2763 			mt->mt_txtype = BWN_DMADESC_METATYPE_BODY;
2764 			mt->mt_m = NULL;
2765 			mt->mt_ni = NULL;
2766 			mt->mt_islast = 1;
2767 			error = bus_dmamap_create(dma->txbuf_dtag, 0,
2768 			    &mt->mt_dmap);
2769 			if (error) {
2770 				device_printf(sc->sc_dev,
2771 				     "can't create RX buf DMA map\n");
2772 				goto fail2;
2773 			}
2774 		}
2775 	} else {
2776 		error = bus_dmamap_create(dma->rxbuf_dtag, 0,
2777 		    &dr->dr_spare_dmap);
2778 		if (error) {
2779 			device_printf(sc->sc_dev,
2780 			    "can't create RX buf DMA map\n");
2781 			goto out;		/* XXX wrong! */
2782 		}
2783 
2784 		for (i = 0; i < dr->dr_numslots; i++) {
2785 			dr->getdesc(dr, i, &desc, &mt);
2786 
2787 			error = bus_dmamap_create(dma->rxbuf_dtag, 0,
2788 			    &mt->mt_dmap);
2789 			if (error) {
2790 				device_printf(sc->sc_dev,
2791 				    "can't create RX buf DMA map\n");
2792 				goto out;	/* XXX wrong! */
2793 			}
2794 			error = bwn_dma_newbuf(dr, desc, mt, 1);
2795 			if (error) {
2796 				device_printf(sc->sc_dev,
2797 				    "failed to allocate RX buf\n");
2798 				goto out;	/* XXX wrong! */
2799 			}
2800 		}
2801 
2802 		bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
2803 		    BUS_DMASYNC_PREWRITE);
2804 
2805 		dr->dr_usedslot = dr->dr_numslots;
2806 	}
2807 
2808       out:
2809 	return (dr);
2810 
2811 fail2:
2812 	if (dr->dr_txhdr_cache != NULL) {
2813 		contigfree(dr->dr_txhdr_cache,
2814 		    (dr->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2815 		    BWN_MAXTXHDRSIZE, M_DEVBUF);
2816 	}
2817 fail1:
2818 	free(dr->dr_meta, M_DEVBUF);
2819 fail0:
2820 	free(dr, M_DEVBUF);
2821 	return (NULL);
2822 }
2823 
2824 static void
2825 bwn_dma_ringfree(struct bwn_dma_ring **dr)
2826 {
2827 
2828 	if (dr == NULL)
2829 		return;
2830 
2831 	bwn_dma_free_descbufs(*dr);
2832 	bwn_dma_free_ringmemory(*dr);
2833 
2834 	if ((*dr)->dr_txhdr_cache != NULL) {
2835 		contigfree((*dr)->dr_txhdr_cache,
2836 		    ((*dr)->dr_numslots / BWN_TX_SLOTS_PER_FRAME) *
2837 		    BWN_MAXTXHDRSIZE, M_DEVBUF);
2838 	}
2839 	free((*dr)->dr_meta, M_DEVBUF);
2840 	free(*dr, M_DEVBUF);
2841 
2842 	*dr = NULL;
2843 }
2844 
2845 static void
2846 bwn_dma_32_getdesc(struct bwn_dma_ring *dr, int slot,
2847     struct bwn_dmadesc_generic **gdesc, struct bwn_dmadesc_meta **meta)
2848 {
2849 	struct bwn_dmadesc32 *desc;
2850 
2851 	*meta = &(dr->dr_meta[slot]);
2852 	desc = dr->dr_ring_descbase;
2853 	desc = &(desc[slot]);
2854 
2855 	*gdesc = (struct bwn_dmadesc_generic *)desc;
2856 }
2857 
2858 static void
2859 bwn_dma_32_setdesc(struct bwn_dma_ring *dr,
2860     struct bwn_dmadesc_generic *desc, bus_addr_t dmaaddr, uint16_t bufsize,
2861     int start, int end, int irq)
2862 {
2863 	struct bwn_dmadesc32 *descbase = dr->dr_ring_descbase;
2864 	struct bwn_softc *sc = dr->dr_mac->mac_sc;
2865 	uint32_t addr, addrext, ctl;
2866 	int slot;
2867 
2868 	slot = (int)(&(desc->dma.dma32) - descbase);
2869 	KASSERT(slot >= 0 && slot < dr->dr_numslots,
2870 	    ("%s:%d: fail", __func__, __LINE__));
2871 
2872 	addr = (uint32_t) (dmaaddr & ~SIBA_DMA_TRANSLATION_MASK);
2873 	addrext = (uint32_t) (dmaaddr & SIBA_DMA_TRANSLATION_MASK) >> 30;
2874 	addr |= siba_dma_translation(sc->sc_dev);
2875 	ctl = bufsize & BWN_DMA32_DCTL_BYTECNT;
2876 	if (slot == dr->dr_numslots - 1)
2877 		ctl |= BWN_DMA32_DCTL_DTABLEEND;
2878 	if (start)
2879 		ctl |= BWN_DMA32_DCTL_FRAMESTART;
2880 	if (end)
2881 		ctl |= BWN_DMA32_DCTL_FRAMEEND;
2882 	if (irq)
2883 		ctl |= BWN_DMA32_DCTL_IRQ;
2884 	ctl |= (addrext << BWN_DMA32_DCTL_ADDREXT_SHIFT)
2885 	    & BWN_DMA32_DCTL_ADDREXT_MASK;
2886 
2887 	desc->dma.dma32.control = htole32(ctl);
2888 	desc->dma.dma32.address = htole32(addr);
2889 }
2890 
2891 static void
2892 bwn_dma_32_start_transfer(struct bwn_dma_ring *dr, int slot)
2893 {
2894 
2895 	BWN_DMA_WRITE(dr, BWN_DMA32_TXINDEX,
2896 	    (uint32_t)(slot * sizeof(struct bwn_dmadesc32)));
2897 }
2898 
2899 static void
2900 bwn_dma_32_suspend(struct bwn_dma_ring *dr)
2901 {
2902 
2903 	BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL,
2904 	    BWN_DMA_READ(dr, BWN_DMA32_TXCTL) | BWN_DMA32_TXSUSPEND);
2905 }
2906 
2907 static void
2908 bwn_dma_32_resume(struct bwn_dma_ring *dr)
2909 {
2910 
2911 	BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL,
2912 	    BWN_DMA_READ(dr, BWN_DMA32_TXCTL) & ~BWN_DMA32_TXSUSPEND);
2913 }
2914 
2915 static int
2916 bwn_dma_32_get_curslot(struct bwn_dma_ring *dr)
2917 {
2918 	uint32_t val;
2919 
2920 	val = BWN_DMA_READ(dr, BWN_DMA32_RXSTATUS);
2921 	val &= BWN_DMA32_RXDPTR;
2922 
2923 	return (val / sizeof(struct bwn_dmadesc32));
2924 }
2925 
2926 static void
2927 bwn_dma_32_set_curslot(struct bwn_dma_ring *dr, int slot)
2928 {
2929 
2930 	BWN_DMA_WRITE(dr, BWN_DMA32_RXINDEX,
2931 	    (uint32_t) (slot * sizeof(struct bwn_dmadesc32)));
2932 }
2933 
2934 static void
2935 bwn_dma_64_getdesc(struct bwn_dma_ring *dr, int slot,
2936     struct bwn_dmadesc_generic **gdesc, struct bwn_dmadesc_meta **meta)
2937 {
2938 	struct bwn_dmadesc64 *desc;
2939 
2940 	*meta = &(dr->dr_meta[slot]);
2941 	desc = dr->dr_ring_descbase;
2942 	desc = &(desc[slot]);
2943 
2944 	*gdesc = (struct bwn_dmadesc_generic *)desc;
2945 }
2946 
2947 static void
2948 bwn_dma_64_setdesc(struct bwn_dma_ring *dr,
2949     struct bwn_dmadesc_generic *desc, bus_addr_t dmaaddr, uint16_t bufsize,
2950     int start, int end, int irq)
2951 {
2952 	struct bwn_dmadesc64 *descbase = dr->dr_ring_descbase;
2953 	struct bwn_softc *sc = dr->dr_mac->mac_sc;
2954 	int slot;
2955 	uint32_t ctl0 = 0, ctl1 = 0;
2956 	uint32_t addrlo, addrhi;
2957 	uint32_t addrext;
2958 
2959 	slot = (int)(&(desc->dma.dma64) - descbase);
2960 	KASSERT(slot >= 0 && slot < dr->dr_numslots,
2961 	    ("%s:%d: fail", __func__, __LINE__));
2962 
2963 	addrlo = (uint32_t) (dmaaddr & 0xffffffff);
2964 	addrhi = (((uint64_t) dmaaddr >> 32) & ~SIBA_DMA_TRANSLATION_MASK);
2965 	addrext = (((uint64_t) dmaaddr >> 32) & SIBA_DMA_TRANSLATION_MASK) >>
2966 	    30;
2967 	addrhi |= (siba_dma_translation(sc->sc_dev) << 1);
2968 	if (slot == dr->dr_numslots - 1)
2969 		ctl0 |= BWN_DMA64_DCTL0_DTABLEEND;
2970 	if (start)
2971 		ctl0 |= BWN_DMA64_DCTL0_FRAMESTART;
2972 	if (end)
2973 		ctl0 |= BWN_DMA64_DCTL0_FRAMEEND;
2974 	if (irq)
2975 		ctl0 |= BWN_DMA64_DCTL0_IRQ;
2976 	ctl1 |= bufsize & BWN_DMA64_DCTL1_BYTECNT;
2977 	ctl1 |= (addrext << BWN_DMA64_DCTL1_ADDREXT_SHIFT)
2978 	    & BWN_DMA64_DCTL1_ADDREXT_MASK;
2979 
2980 	desc->dma.dma64.control0 = htole32(ctl0);
2981 	desc->dma.dma64.control1 = htole32(ctl1);
2982 	desc->dma.dma64.address_low = htole32(addrlo);
2983 	desc->dma.dma64.address_high = htole32(addrhi);
2984 }
2985 
2986 static void
2987 bwn_dma_64_start_transfer(struct bwn_dma_ring *dr, int slot)
2988 {
2989 
2990 	BWN_DMA_WRITE(dr, BWN_DMA64_TXINDEX,
2991 	    (uint32_t)(slot * sizeof(struct bwn_dmadesc64)));
2992 }
2993 
2994 static void
2995 bwn_dma_64_suspend(struct bwn_dma_ring *dr)
2996 {
2997 
2998 	BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL,
2999 	    BWN_DMA_READ(dr, BWN_DMA64_TXCTL) | BWN_DMA64_TXSUSPEND);
3000 }
3001 
3002 static void
3003 bwn_dma_64_resume(struct bwn_dma_ring *dr)
3004 {
3005 
3006 	BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL,
3007 	    BWN_DMA_READ(dr, BWN_DMA64_TXCTL) & ~BWN_DMA64_TXSUSPEND);
3008 }
3009 
3010 static int
3011 bwn_dma_64_get_curslot(struct bwn_dma_ring *dr)
3012 {
3013 	uint32_t val;
3014 
3015 	val = BWN_DMA_READ(dr, BWN_DMA64_RXSTATUS);
3016 	val &= BWN_DMA64_RXSTATDPTR;
3017 
3018 	return (val / sizeof(struct bwn_dmadesc64));
3019 }
3020 
3021 static void
3022 bwn_dma_64_set_curslot(struct bwn_dma_ring *dr, int slot)
3023 {
3024 
3025 	BWN_DMA_WRITE(dr, BWN_DMA64_RXINDEX,
3026 	    (uint32_t)(slot * sizeof(struct bwn_dmadesc64)));
3027 }
3028 
3029 static int
3030 bwn_dma_allocringmemory(struct bwn_dma_ring *dr)
3031 {
3032 	struct bwn_mac *mac = dr->dr_mac;
3033 	struct bwn_dma *dma = &mac->mac_method.dma;
3034 	struct bwn_softc *sc = mac->mac_sc;
3035 	int error;
3036 
3037 	error = bus_dma_tag_create(dma->parent_dtag,
3038 			    BWN_ALIGN, 0,
3039 			    BUS_SPACE_MAXADDR,
3040 			    BUS_SPACE_MAXADDR,
3041 			    NULL, NULL,
3042 			    BWN_DMA_RINGMEMSIZE,
3043 			    1,
3044 			    BUS_SPACE_MAXSIZE_32BIT,
3045 			    0,
3046 			    NULL, NULL,
3047 			    &dr->dr_ring_dtag);
3048 	if (error) {
3049 		device_printf(sc->sc_dev,
3050 		    "can't create TX ring DMA tag: TODO frees\n");
3051 		return (-1);
3052 	}
3053 
3054 	error = bus_dmamem_alloc(dr->dr_ring_dtag,
3055 	    &dr->dr_ring_descbase, BUS_DMA_WAITOK | BUS_DMA_ZERO,
3056 	    &dr->dr_ring_dmap);
3057 	if (error) {
3058 		device_printf(sc->sc_dev,
3059 		    "can't allocate DMA mem: TODO frees\n");
3060 		return (-1);
3061 	}
3062 	error = bus_dmamap_load(dr->dr_ring_dtag, dr->dr_ring_dmap,
3063 	    dr->dr_ring_descbase, BWN_DMA_RINGMEMSIZE,
3064 	    bwn_dma_ring_addr, &dr->dr_ring_dmabase, BUS_DMA_NOWAIT);
3065 	if (error) {
3066 		device_printf(sc->sc_dev,
3067 		    "can't load DMA mem: TODO free\n");
3068 		return (-1);
3069 	}
3070 
3071 	return (0);
3072 }
3073 
3074 static void
3075 bwn_dma_setup(struct bwn_dma_ring *dr)
3076 {
3077 	struct bwn_softc *sc = dr->dr_mac->mac_sc;
3078 	uint64_t ring64;
3079 	uint32_t addrext, ring32, value;
3080 	uint32_t trans = siba_dma_translation(sc->sc_dev);
3081 
3082 	if (dr->dr_tx) {
3083 		dr->dr_curslot = -1;
3084 
3085 		if (dr->dr_type == BWN_DMA_64BIT) {
3086 			ring64 = (uint64_t)(dr->dr_ring_dmabase);
3087 			addrext = ((ring64 >> 32) & SIBA_DMA_TRANSLATION_MASK)
3088 			    >> 30;
3089 			value = BWN_DMA64_TXENABLE;
3090 			value |= (addrext << BWN_DMA64_TXADDREXT_SHIFT)
3091 			    & BWN_DMA64_TXADDREXT_MASK;
3092 			BWN_DMA_WRITE(dr, BWN_DMA64_TXCTL, value);
3093 			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGLO,
3094 			    (ring64 & 0xffffffff));
3095 			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGHI,
3096 			    ((ring64 >> 32) &
3097 			    ~SIBA_DMA_TRANSLATION_MASK) | (trans << 1));
3098 		} else {
3099 			ring32 = (uint32_t)(dr->dr_ring_dmabase);
3100 			addrext = (ring32 & SIBA_DMA_TRANSLATION_MASK) >> 30;
3101 			value = BWN_DMA32_TXENABLE;
3102 			value |= (addrext << BWN_DMA32_TXADDREXT_SHIFT)
3103 			    & BWN_DMA32_TXADDREXT_MASK;
3104 			BWN_DMA_WRITE(dr, BWN_DMA32_TXCTL, value);
3105 			BWN_DMA_WRITE(dr, BWN_DMA32_TXRING,
3106 			    (ring32 & ~SIBA_DMA_TRANSLATION_MASK) | trans);
3107 		}
3108 		return;
3109 	}
3110 
3111 	/*
3112 	 * set for RX
3113 	 */
3114 	dr->dr_usedslot = dr->dr_numslots;
3115 
3116 	if (dr->dr_type == BWN_DMA_64BIT) {
3117 		ring64 = (uint64_t)(dr->dr_ring_dmabase);
3118 		addrext = ((ring64 >> 32) & SIBA_DMA_TRANSLATION_MASK) >> 30;
3119 		value = (dr->dr_frameoffset << BWN_DMA64_RXFROFF_SHIFT);
3120 		value |= BWN_DMA64_RXENABLE;
3121 		value |= (addrext << BWN_DMA64_RXADDREXT_SHIFT)
3122 		    & BWN_DMA64_RXADDREXT_MASK;
3123 		BWN_DMA_WRITE(dr, BWN_DMA64_RXCTL, value);
3124 		BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGLO, (ring64 & 0xffffffff));
3125 		BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGHI,
3126 		    ((ring64 >> 32) & ~SIBA_DMA_TRANSLATION_MASK)
3127 		    | (trans << 1));
3128 		BWN_DMA_WRITE(dr, BWN_DMA64_RXINDEX, dr->dr_numslots *
3129 		    sizeof(struct bwn_dmadesc64));
3130 	} else {
3131 		ring32 = (uint32_t)(dr->dr_ring_dmabase);
3132 		addrext = (ring32 & SIBA_DMA_TRANSLATION_MASK) >> 30;
3133 		value = (dr->dr_frameoffset << BWN_DMA32_RXFROFF_SHIFT);
3134 		value |= BWN_DMA32_RXENABLE;
3135 		value |= (addrext << BWN_DMA32_RXADDREXT_SHIFT)
3136 		    & BWN_DMA32_RXADDREXT_MASK;
3137 		BWN_DMA_WRITE(dr, BWN_DMA32_RXCTL, value);
3138 		BWN_DMA_WRITE(dr, BWN_DMA32_RXRING,
3139 		    (ring32 & ~SIBA_DMA_TRANSLATION_MASK) | trans);
3140 		BWN_DMA_WRITE(dr, BWN_DMA32_RXINDEX, dr->dr_numslots *
3141 		    sizeof(struct bwn_dmadesc32));
3142 	}
3143 }
3144 
3145 static void
3146 bwn_dma_free_ringmemory(struct bwn_dma_ring *dr)
3147 {
3148 
3149 	bus_dmamap_unload(dr->dr_ring_dtag, dr->dr_ring_dmap);
3150 	bus_dmamem_free(dr->dr_ring_dtag, dr->dr_ring_descbase,
3151 	    dr->dr_ring_dmap);
3152 }
3153 
3154 static void
3155 bwn_dma_cleanup(struct bwn_dma_ring *dr)
3156 {
3157 
3158 	if (dr->dr_tx) {
3159 		bwn_dma_tx_reset(dr->dr_mac, dr->dr_base, dr->dr_type);
3160 		if (dr->dr_type == BWN_DMA_64BIT) {
3161 			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGLO, 0);
3162 			BWN_DMA_WRITE(dr, BWN_DMA64_TXRINGHI, 0);
3163 		} else
3164 			BWN_DMA_WRITE(dr, BWN_DMA32_TXRING, 0);
3165 	} else {
3166 		bwn_dma_rx_reset(dr->dr_mac, dr->dr_base, dr->dr_type);
3167 		if (dr->dr_type == BWN_DMA_64BIT) {
3168 			BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGLO, 0);
3169 			BWN_DMA_WRITE(dr, BWN_DMA64_RXRINGHI, 0);
3170 		} else
3171 			BWN_DMA_WRITE(dr, BWN_DMA32_RXRING, 0);
3172 	}
3173 }
3174 
3175 static void
3176 bwn_dma_free_descbufs(struct bwn_dma_ring *dr)
3177 {
3178 	struct bwn_dmadesc_generic *desc;
3179 	struct bwn_dmadesc_meta *meta;
3180 	struct bwn_mac *mac = dr->dr_mac;
3181 	struct bwn_dma *dma = &mac->mac_method.dma;
3182 	struct bwn_softc *sc = mac->mac_sc;
3183 	int i;
3184 
3185 	if (!dr->dr_usedslot)
3186 		return;
3187 	for (i = 0; i < dr->dr_numslots; i++) {
3188 		dr->getdesc(dr, i, &desc, &meta);
3189 
3190 		if (meta->mt_m == NULL) {
3191 			if (!dr->dr_tx)
3192 				device_printf(sc->sc_dev, "%s: not TX?\n",
3193 				    __func__);
3194 			continue;
3195 		}
3196 		if (dr->dr_tx) {
3197 			if (meta->mt_txtype == BWN_DMADESC_METATYPE_HEADER)
3198 				bus_dmamap_unload(dr->dr_txring_dtag,
3199 				    meta->mt_dmap);
3200 			else if (meta->mt_txtype == BWN_DMADESC_METATYPE_BODY)
3201 				bus_dmamap_unload(dma->txbuf_dtag,
3202 				    meta->mt_dmap);
3203 		} else
3204 			bus_dmamap_unload(dma->rxbuf_dtag, meta->mt_dmap);
3205 		bwn_dma_free_descbuf(dr, meta);
3206 	}
3207 }
3208 
3209 static int
3210 bwn_dma_tx_reset(struct bwn_mac *mac, uint16_t base,
3211     int type)
3212 {
3213 	struct bwn_softc *sc = mac->mac_sc;
3214 	uint32_t value;
3215 	int i;
3216 	uint16_t offset;
3217 
3218 	for (i = 0; i < 10; i++) {
3219 		offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXSTATUS :
3220 		    BWN_DMA32_TXSTATUS;
3221 		value = BWN_READ_4(mac, base + offset);
3222 		if (type == BWN_DMA_64BIT) {
3223 			value &= BWN_DMA64_TXSTAT;
3224 			if (value == BWN_DMA64_TXSTAT_DISABLED ||
3225 			    value == BWN_DMA64_TXSTAT_IDLEWAIT ||
3226 			    value == BWN_DMA64_TXSTAT_STOPPED)
3227 				break;
3228 		} else {
3229 			value &= BWN_DMA32_TXSTATE;
3230 			if (value == BWN_DMA32_TXSTAT_DISABLED ||
3231 			    value == BWN_DMA32_TXSTAT_IDLEWAIT ||
3232 			    value == BWN_DMA32_TXSTAT_STOPPED)
3233 				break;
3234 		}
3235 		DELAY(1000);
3236 	}
3237 	offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXCTL : BWN_DMA32_TXCTL;
3238 	BWN_WRITE_4(mac, base + offset, 0);
3239 	for (i = 0; i < 10; i++) {
3240 		offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_TXSTATUS :
3241 						   BWN_DMA32_TXSTATUS;
3242 		value = BWN_READ_4(mac, base + offset);
3243 		if (type == BWN_DMA_64BIT) {
3244 			value &= BWN_DMA64_TXSTAT;
3245 			if (value == BWN_DMA64_TXSTAT_DISABLED) {
3246 				i = -1;
3247 				break;
3248 			}
3249 		} else {
3250 			value &= BWN_DMA32_TXSTATE;
3251 			if (value == BWN_DMA32_TXSTAT_DISABLED) {
3252 				i = -1;
3253 				break;
3254 			}
3255 		}
3256 		DELAY(1000);
3257 	}
3258 	if (i != -1) {
3259 		device_printf(sc->sc_dev, "%s: timed out\n", __func__);
3260 		return (ENODEV);
3261 	}
3262 	DELAY(1000);
3263 
3264 	return (0);
3265 }
3266 
3267 static int
3268 bwn_dma_rx_reset(struct bwn_mac *mac, uint16_t base,
3269     int type)
3270 {
3271 	struct bwn_softc *sc = mac->mac_sc;
3272 	uint32_t value;
3273 	int i;
3274 	uint16_t offset;
3275 
3276 	offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_RXCTL : BWN_DMA32_RXCTL;
3277 	BWN_WRITE_4(mac, base + offset, 0);
3278 	for (i = 0; i < 10; i++) {
3279 		offset = (type == BWN_DMA_64BIT) ? BWN_DMA64_RXSTATUS :
3280 		    BWN_DMA32_RXSTATUS;
3281 		value = BWN_READ_4(mac, base + offset);
3282 		if (type == BWN_DMA_64BIT) {
3283 			value &= BWN_DMA64_RXSTAT;
3284 			if (value == BWN_DMA64_RXSTAT_DISABLED) {
3285 				i = -1;
3286 				break;
3287 			}
3288 		} else {
3289 			value &= BWN_DMA32_RXSTATE;
3290 			if (value == BWN_DMA32_RXSTAT_DISABLED) {
3291 				i = -1;
3292 				break;
3293 			}
3294 		}
3295 		DELAY(1000);
3296 	}
3297 	if (i != -1) {
3298 		device_printf(sc->sc_dev, "%s: timed out\n", __func__);
3299 		return (ENODEV);
3300 	}
3301 
3302 	return (0);
3303 }
3304 
3305 static void
3306 bwn_dma_free_descbuf(struct bwn_dma_ring *dr,
3307     struct bwn_dmadesc_meta *meta)
3308 {
3309 
3310 	if (meta->mt_m != NULL) {
3311 		m_freem(meta->mt_m);
3312 		meta->mt_m = NULL;
3313 	}
3314 	if (meta->mt_ni != NULL) {
3315 		ieee80211_free_node(meta->mt_ni);
3316 		meta->mt_ni = NULL;
3317 	}
3318 }
3319 
3320 static void
3321 bwn_dma_set_redzone(struct bwn_dma_ring *dr, struct mbuf *m)
3322 {
3323 	struct bwn_rxhdr4 *rxhdr;
3324 	unsigned char *frame;
3325 
3326 	rxhdr = mtod(m, struct bwn_rxhdr4 *);
3327 	rxhdr->frame_len = 0;
3328 
3329 	KASSERT(dr->dr_rx_bufsize >= dr->dr_frameoffset +
3330 	    sizeof(struct bwn_plcp6) + 2,
3331 	    ("%s:%d: fail", __func__, __LINE__));
3332 	frame = mtod(m, char *) + dr->dr_frameoffset;
3333 	memset(frame, 0xff, sizeof(struct bwn_plcp6) + 2 /* padding */);
3334 }
3335 
3336 static uint8_t
3337 bwn_dma_check_redzone(struct bwn_dma_ring *dr, struct mbuf *m)
3338 {
3339 	unsigned char *f = mtod(m, char *) + dr->dr_frameoffset;
3340 
3341 	return ((f[0] & f[1] & f[2] & f[3] & f[4] & f[5] & f[6] & f[7])
3342 	    == 0xff);
3343 }
3344 
3345 static void
3346 bwn_wme_init(struct bwn_mac *mac)
3347 {
3348 
3349 	bwn_wme_load(mac);
3350 
3351 	/* enable WME support. */
3352 	bwn_hf_write(mac, bwn_hf_read(mac) | BWN_HF_EDCF);
3353 	BWN_WRITE_2(mac, BWN_IFSCTL, BWN_READ_2(mac, BWN_IFSCTL) |
3354 	    BWN_IFSCTL_USE_EDCF);
3355 }
3356 
3357 static void
3358 bwn_spu_setdelay(struct bwn_mac *mac, int idle)
3359 {
3360 	struct bwn_softc *sc = mac->mac_sc;
3361 	struct ieee80211com *ic = &sc->sc_ic;
3362 	uint16_t delay;	/* microsec */
3363 
3364 	delay = (mac->mac_phy.type == BWN_PHYTYPE_A) ? 3700 : 1050;
3365 	if (ic->ic_opmode == IEEE80211_M_IBSS || idle)
3366 		delay = 500;
3367 	if ((mac->mac_phy.rf_ver == 0x2050) && (mac->mac_phy.rf_rev == 8))
3368 		delay = max(delay, (uint16_t)2400);
3369 
3370 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_SPU_WAKEUP, delay);
3371 }
3372 
3373 static void
3374 bwn_bt_enable(struct bwn_mac *mac)
3375 {
3376 	struct bwn_softc *sc = mac->mac_sc;
3377 	uint64_t hf;
3378 
3379 	if (bwn_bluetooth == 0)
3380 		return;
3381 	if ((siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_BTCOEXIST) == 0)
3382 		return;
3383 	if (mac->mac_phy.type != BWN_PHYTYPE_B && !mac->mac_phy.gmode)
3384 		return;
3385 
3386 	hf = bwn_hf_read(mac);
3387 	if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_BTCMOD)
3388 		hf |= BWN_HF_BT_COEXISTALT;
3389 	else
3390 		hf |= BWN_HF_BT_COEXIST;
3391 	bwn_hf_write(mac, hf);
3392 }
3393 
3394 static void
3395 bwn_set_macaddr(struct bwn_mac *mac)
3396 {
3397 
3398 	bwn_mac_write_bssid(mac);
3399 	bwn_mac_setfilter(mac, BWN_MACFILTER_SELF,
3400 	    mac->mac_sc->sc_ic.ic_macaddr);
3401 }
3402 
3403 static void
3404 bwn_clear_keys(struct bwn_mac *mac)
3405 {
3406 	int i;
3407 
3408 	for (i = 0; i < mac->mac_max_nr_keys; i++) {
3409 		KASSERT(i >= 0 && i < mac->mac_max_nr_keys,
3410 		    ("%s:%d: fail", __func__, __LINE__));
3411 
3412 		bwn_key_dowrite(mac, i, BWN_SEC_ALGO_NONE,
3413 		    NULL, BWN_SEC_KEYSIZE, NULL);
3414 		if ((i <= 3) && !BWN_SEC_NEWAPI(mac)) {
3415 			bwn_key_dowrite(mac, i + 4, BWN_SEC_ALGO_NONE,
3416 			    NULL, BWN_SEC_KEYSIZE, NULL);
3417 		}
3418 		mac->mac_key[i].keyconf = NULL;
3419 	}
3420 }
3421 
3422 static void
3423 bwn_crypt_init(struct bwn_mac *mac)
3424 {
3425 	struct bwn_softc *sc = mac->mac_sc;
3426 
3427 	mac->mac_max_nr_keys = (siba_get_revid(sc->sc_dev) >= 5) ? 58 : 20;
3428 	KASSERT(mac->mac_max_nr_keys <= N(mac->mac_key),
3429 	    ("%s:%d: fail", __func__, __LINE__));
3430 	mac->mac_ktp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_KEY_TABLEP);
3431 	mac->mac_ktp *= 2;
3432 	if (siba_get_revid(sc->sc_dev) >= 5)
3433 		BWN_WRITE_2(mac, BWN_RCMTA_COUNT, mac->mac_max_nr_keys - 8);
3434 	bwn_clear_keys(mac);
3435 }
3436 
3437 static void
3438 bwn_chip_exit(struct bwn_mac *mac)
3439 {
3440 	struct bwn_softc *sc = mac->mac_sc;
3441 
3442 	bwn_phy_exit(mac);
3443 	siba_gpio_set(sc->sc_dev, 0);
3444 }
3445 
3446 static int
3447 bwn_fw_fillinfo(struct bwn_mac *mac)
3448 {
3449 	int error;
3450 
3451 	error = bwn_fw_gets(mac, BWN_FWTYPE_DEFAULT);
3452 	if (error == 0)
3453 		return (0);
3454 	error = bwn_fw_gets(mac, BWN_FWTYPE_OPENSOURCE);
3455 	if (error == 0)
3456 		return (0);
3457 	return (error);
3458 }
3459 
3460 static int
3461 bwn_gpio_init(struct bwn_mac *mac)
3462 {
3463 	struct bwn_softc *sc = mac->mac_sc;
3464 	uint32_t mask = 0x1f, set = 0xf, value;
3465 
3466 	BWN_WRITE_4(mac, BWN_MACCTL,
3467 	    BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_GPOUT_MASK);
3468 	BWN_WRITE_2(mac, BWN_GPIO_MASK,
3469 	    BWN_READ_2(mac, BWN_GPIO_MASK) | 0x000f);
3470 
3471 	if (siba_get_chipid(sc->sc_dev) == 0x4301) {
3472 		mask |= 0x0060;
3473 		set |= 0x0060;
3474 	}
3475 	if (siba_sprom_get_bf_lo(sc->sc_dev) & BWN_BFL_PACTRL) {
3476 		BWN_WRITE_2(mac, BWN_GPIO_MASK,
3477 		    BWN_READ_2(mac, BWN_GPIO_MASK) | 0x0200);
3478 		mask |= 0x0200;
3479 		set |= 0x0200;
3480 	}
3481 	if (siba_get_revid(sc->sc_dev) >= 2)
3482 		mask |= 0x0010;
3483 
3484 	value = siba_gpio_get(sc->sc_dev);
3485 	if (value == -1)
3486 		return (0);
3487 	siba_gpio_set(sc->sc_dev, (value & mask) | set);
3488 
3489 	return (0);
3490 }
3491 
3492 static int
3493 bwn_fw_loadinitvals(struct bwn_mac *mac)
3494 {
3495 #define	GETFWOFFSET(fwp, offset)				\
3496 	((const struct bwn_fwinitvals *)((const char *)fwp.fw->data + offset))
3497 	const size_t hdr_len = sizeof(struct bwn_fwhdr);
3498 	const struct bwn_fwhdr *hdr;
3499 	struct bwn_fw *fw = &mac->mac_fw;
3500 	int error;
3501 
3502 	hdr = (const struct bwn_fwhdr *)(fw->initvals.fw->data);
3503 	error = bwn_fwinitvals_write(mac, GETFWOFFSET(fw->initvals, hdr_len),
3504 	    be32toh(hdr->size), fw->initvals.fw->datasize - hdr_len);
3505 	if (error)
3506 		return (error);
3507 	if (fw->initvals_band.fw) {
3508 		hdr = (const struct bwn_fwhdr *)(fw->initvals_band.fw->data);
3509 		error = bwn_fwinitvals_write(mac,
3510 		    GETFWOFFSET(fw->initvals_band, hdr_len),
3511 		    be32toh(hdr->size),
3512 		    fw->initvals_band.fw->datasize - hdr_len);
3513 	}
3514 	return (error);
3515 #undef GETFWOFFSET
3516 }
3517 
3518 static int
3519 bwn_phy_init(struct bwn_mac *mac)
3520 {
3521 	struct bwn_softc *sc = mac->mac_sc;
3522 	int error;
3523 
3524 	mac->mac_phy.chan = mac->mac_phy.get_default_chan(mac);
3525 	mac->mac_phy.rf_onoff(mac, 1);
3526 	error = mac->mac_phy.init(mac);
3527 	if (error) {
3528 		device_printf(sc->sc_dev, "PHY init failed\n");
3529 		goto fail0;
3530 	}
3531 	error = bwn_switch_channel(mac,
3532 	    mac->mac_phy.get_default_chan(mac));
3533 	if (error) {
3534 		device_printf(sc->sc_dev,
3535 		    "failed to switch default channel\n");
3536 		goto fail1;
3537 	}
3538 	return (0);
3539 fail1:
3540 	if (mac->mac_phy.exit)
3541 		mac->mac_phy.exit(mac);
3542 fail0:
3543 	mac->mac_phy.rf_onoff(mac, 0);
3544 
3545 	return (error);
3546 }
3547 
3548 static void
3549 bwn_set_txantenna(struct bwn_mac *mac, int antenna)
3550 {
3551 	uint16_t ant;
3552 	uint16_t tmp;
3553 
3554 	ant = bwn_ant2phy(antenna);
3555 
3556 	/* For ACK/CTS */
3557 	tmp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL);
3558 	tmp = (tmp & ~BWN_TX_PHY_ANT) | ant;
3559 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_ACKCTS_PHYCTL, tmp);
3560 	/* For Probe Resposes */
3561 	tmp = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL);
3562 	tmp = (tmp & ~BWN_TX_PHY_ANT) | ant;
3563 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PROBE_RESP_PHYCTL, tmp);
3564 }
3565 
3566 static void
3567 bwn_set_opmode(struct bwn_mac *mac)
3568 {
3569 	struct bwn_softc *sc = mac->mac_sc;
3570 	struct ieee80211com *ic = &sc->sc_ic;
3571 	uint32_t ctl;
3572 	uint16_t cfp_pretbtt;
3573 
3574 	ctl = BWN_READ_4(mac, BWN_MACCTL);
3575 	ctl &= ~(BWN_MACCTL_HOSTAP | BWN_MACCTL_PASS_CTL |
3576 	    BWN_MACCTL_PASS_BADPLCP | BWN_MACCTL_PASS_BADFCS |
3577 	    BWN_MACCTL_PROMISC | BWN_MACCTL_BEACON_PROMISC);
3578 	ctl |= BWN_MACCTL_STA;
3579 
3580 	if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
3581 	    ic->ic_opmode == IEEE80211_M_MBSS)
3582 		ctl |= BWN_MACCTL_HOSTAP;
3583 	else if (ic->ic_opmode == IEEE80211_M_IBSS)
3584 		ctl &= ~BWN_MACCTL_STA;
3585 	ctl |= sc->sc_filters;
3586 
3587 	if (siba_get_revid(sc->sc_dev) <= 4)
3588 		ctl |= BWN_MACCTL_PROMISC;
3589 
3590 	BWN_WRITE_4(mac, BWN_MACCTL, ctl);
3591 
3592 	cfp_pretbtt = 2;
3593 	if ((ctl & BWN_MACCTL_STA) && !(ctl & BWN_MACCTL_HOSTAP)) {
3594 		if (siba_get_chipid(sc->sc_dev) == 0x4306 &&
3595 		    siba_get_chiprev(sc->sc_dev) == 3)
3596 			cfp_pretbtt = 100;
3597 		else
3598 			cfp_pretbtt = 50;
3599 	}
3600 	BWN_WRITE_2(mac, 0x612, cfp_pretbtt);
3601 }
3602 
3603 static int
3604 bwn_dma_gettype(struct bwn_mac *mac)
3605 {
3606 	uint32_t tmp;
3607 	uint16_t base;
3608 
3609 	tmp = BWN_READ_4(mac, SIBA_TGSHIGH);
3610 	if (tmp & SIBA_TGSHIGH_DMA64)
3611 		return (BWN_DMA_64BIT);
3612 	base = bwn_dma_base(0, 0);
3613 	BWN_WRITE_4(mac, base + BWN_DMA32_TXCTL, BWN_DMA32_TXADDREXT_MASK);
3614 	tmp = BWN_READ_4(mac, base + BWN_DMA32_TXCTL);
3615 	if (tmp & BWN_DMA32_TXADDREXT_MASK)
3616 		return (BWN_DMA_32BIT);
3617 
3618 	return (BWN_DMA_30BIT);
3619 }
3620 
3621 static void
3622 bwn_dma_ring_addr(void *arg, bus_dma_segment_t *seg, int nseg, int error)
3623 {
3624 	if (!error) {
3625 		KASSERT(nseg == 1, ("too many segments(%d)\n", nseg));
3626 		*((bus_addr_t *)arg) = seg->ds_addr;
3627 	}
3628 }
3629 
3630 void
3631 bwn_dummy_transmission(struct bwn_mac *mac, int ofdm, int paon)
3632 {
3633 	struct bwn_phy *phy = &mac->mac_phy;
3634 	struct bwn_softc *sc = mac->mac_sc;
3635 	unsigned int i, max_loop;
3636 	uint16_t value;
3637 	uint32_t buffer[5] = {
3638 		0x00000000, 0x00d40000, 0x00000000, 0x01000000, 0x00000000
3639 	};
3640 
3641 	if (ofdm) {
3642 		max_loop = 0x1e;
3643 		buffer[0] = 0x000201cc;
3644 	} else {
3645 		max_loop = 0xfa;
3646 		buffer[0] = 0x000b846e;
3647 	}
3648 
3649 	BWN_ASSERT_LOCKED(mac->mac_sc);
3650 
3651 	for (i = 0; i < 5; i++)
3652 		bwn_ram_write(mac, i * 4, buffer[i]);
3653 
3654 	BWN_WRITE_2(mac, 0x0568, 0x0000);
3655 	BWN_WRITE_2(mac, 0x07c0,
3656 	    (siba_get_revid(sc->sc_dev) < 11) ? 0x0000 : 0x0100);
3657 
3658 	value = (ofdm ? 0x41 : 0x40);
3659 	BWN_WRITE_2(mac, 0x050c, value);
3660 
3661 	if (phy->type == BWN_PHYTYPE_N || phy->type == BWN_PHYTYPE_LP ||
3662 	    phy->type == BWN_PHYTYPE_LCN)
3663 		BWN_WRITE_2(mac, 0x0514, 0x1a02);
3664 	BWN_WRITE_2(mac, 0x0508, 0x0000);
3665 	BWN_WRITE_2(mac, 0x050a, 0x0000);
3666 	BWN_WRITE_2(mac, 0x054c, 0x0000);
3667 	BWN_WRITE_2(mac, 0x056a, 0x0014);
3668 	BWN_WRITE_2(mac, 0x0568, 0x0826);
3669 	BWN_WRITE_2(mac, 0x0500, 0x0000);
3670 
3671 	/* XXX TODO: n phy pa override? */
3672 
3673 	switch (phy->type) {
3674 	case BWN_PHYTYPE_N:
3675 	case BWN_PHYTYPE_LCN:
3676 		BWN_WRITE_2(mac, 0x0502, 0x00d0);
3677 		break;
3678 	case BWN_PHYTYPE_LP:
3679 		BWN_WRITE_2(mac, 0x0502, 0x0050);
3680 		break;
3681 	default:
3682 		BWN_WRITE_2(mac, 0x0502, 0x0030);
3683 		break;
3684 	}
3685 
3686 	/* flush */
3687 	BWN_READ_2(mac, 0x0502);
3688 
3689 	if (phy->rf_ver == 0x2050 && phy->rf_rev <= 0x5)
3690 		BWN_RF_WRITE(mac, 0x0051, 0x0017);
3691 	for (i = 0x00; i < max_loop; i++) {
3692 		value = BWN_READ_2(mac, 0x050e);
3693 		if (value & 0x0080)
3694 			break;
3695 		DELAY(10);
3696 	}
3697 	for (i = 0x00; i < 0x0a; i++) {
3698 		value = BWN_READ_2(mac, 0x050e);
3699 		if (value & 0x0400)
3700 			break;
3701 		DELAY(10);
3702 	}
3703 	for (i = 0x00; i < 0x19; i++) {
3704 		value = BWN_READ_2(mac, 0x0690);
3705 		if (!(value & 0x0100))
3706 			break;
3707 		DELAY(10);
3708 	}
3709 	if (phy->rf_ver == 0x2050 && phy->rf_rev <= 0x5)
3710 		BWN_RF_WRITE(mac, 0x0051, 0x0037);
3711 }
3712 
3713 void
3714 bwn_ram_write(struct bwn_mac *mac, uint16_t offset, uint32_t val)
3715 {
3716 	uint32_t macctl;
3717 
3718 	KASSERT(offset % 4 == 0, ("%s:%d: fail", __func__, __LINE__));
3719 
3720 	macctl = BWN_READ_4(mac, BWN_MACCTL);
3721 	if (macctl & BWN_MACCTL_BIGENDIAN)
3722 		printf("TODO: need swap\n");
3723 
3724 	BWN_WRITE_4(mac, BWN_RAM_CONTROL, offset);
3725 	BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
3726 	BWN_WRITE_4(mac, BWN_RAM_DATA, val);
3727 }
3728 
3729 void
3730 bwn_mac_suspend(struct bwn_mac *mac)
3731 {
3732 	struct bwn_softc *sc = mac->mac_sc;
3733 	int i;
3734 	uint32_t tmp;
3735 
3736 	KASSERT(mac->mac_suspended >= 0,
3737 	    ("%s:%d: fail", __func__, __LINE__));
3738 
3739 	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: suspended=%d\n",
3740 	    __func__, mac->mac_suspended);
3741 
3742 	if (mac->mac_suspended == 0) {
3743 		bwn_psctl(mac, BWN_PS_AWAKE);
3744 		BWN_WRITE_4(mac, BWN_MACCTL,
3745 			    BWN_READ_4(mac, BWN_MACCTL)
3746 			    & ~BWN_MACCTL_ON);
3747 		BWN_READ_4(mac, BWN_MACCTL);
3748 		for (i = 35; i; i--) {
3749 			tmp = BWN_READ_4(mac, BWN_INTR_REASON);
3750 			if (tmp & BWN_INTR_MAC_SUSPENDED)
3751 				goto out;
3752 			DELAY(10);
3753 		}
3754 		for (i = 40; i; i--) {
3755 			tmp = BWN_READ_4(mac, BWN_INTR_REASON);
3756 			if (tmp & BWN_INTR_MAC_SUSPENDED)
3757 				goto out;
3758 			DELAY(1000);
3759 		}
3760 		device_printf(sc->sc_dev, "MAC suspend failed\n");
3761 	}
3762 out:
3763 	mac->mac_suspended++;
3764 }
3765 
3766 void
3767 bwn_mac_enable(struct bwn_mac *mac)
3768 {
3769 	struct bwn_softc *sc = mac->mac_sc;
3770 	uint16_t state;
3771 
3772 	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: suspended=%d\n",
3773 	    __func__, mac->mac_suspended);
3774 
3775 	state = bwn_shm_read_2(mac, BWN_SHARED,
3776 	    BWN_SHARED_UCODESTAT);
3777 	if (state != BWN_SHARED_UCODESTAT_SUSPEND &&
3778 	    state != BWN_SHARED_UCODESTAT_SLEEP) {
3779 		DPRINTF(sc, BWN_DEBUG_FW,
3780 		    "%s: warn: firmware state (%d)\n",
3781 		    __func__, state);
3782 	}
3783 
3784 	mac->mac_suspended--;
3785 	KASSERT(mac->mac_suspended >= 0,
3786 	    ("%s:%d: fail", __func__, __LINE__));
3787 	if (mac->mac_suspended == 0) {
3788 		BWN_WRITE_4(mac, BWN_MACCTL,
3789 		    BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_ON);
3790 		BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_MAC_SUSPENDED);
3791 		BWN_READ_4(mac, BWN_MACCTL);
3792 		BWN_READ_4(mac, BWN_INTR_REASON);
3793 		bwn_psctl(mac, 0);
3794 	}
3795 }
3796 
3797 void
3798 bwn_psctl(struct bwn_mac *mac, uint32_t flags)
3799 {
3800 	struct bwn_softc *sc = mac->mac_sc;
3801 	int i;
3802 	uint16_t ucstat;
3803 
3804 	KASSERT(!((flags & BWN_PS_ON) && (flags & BWN_PS_OFF)),
3805 	    ("%s:%d: fail", __func__, __LINE__));
3806 	KASSERT(!((flags & BWN_PS_AWAKE) && (flags & BWN_PS_ASLEEP)),
3807 	    ("%s:%d: fail", __func__, __LINE__));
3808 
3809 	/* XXX forcibly awake and hwps-off */
3810 
3811 	BWN_WRITE_4(mac, BWN_MACCTL,
3812 	    (BWN_READ_4(mac, BWN_MACCTL) | BWN_MACCTL_AWAKE) &
3813 	    ~BWN_MACCTL_HWPS);
3814 	BWN_READ_4(mac, BWN_MACCTL);
3815 	if (siba_get_revid(sc->sc_dev) >= 5) {
3816 		for (i = 0; i < 100; i++) {
3817 			ucstat = bwn_shm_read_2(mac, BWN_SHARED,
3818 			    BWN_SHARED_UCODESTAT);
3819 			if (ucstat != BWN_SHARED_UCODESTAT_SLEEP)
3820 				break;
3821 			DELAY(10);
3822 		}
3823 	}
3824 	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: ucstat=%d\n", __func__,
3825 	    ucstat);
3826 }
3827 
3828 static int
3829 bwn_fw_gets(struct bwn_mac *mac, enum bwn_fwtype type)
3830 {
3831 	struct bwn_softc *sc = mac->mac_sc;
3832 	struct bwn_fw *fw = &mac->mac_fw;
3833 	const uint8_t rev = siba_get_revid(sc->sc_dev);
3834 	const char *filename;
3835 	uint32_t high;
3836 	int error;
3837 
3838 	/* microcode */
3839 	filename = NULL;
3840 	switch (rev) {
3841 	case 42:
3842 		if (mac->mac_phy.type == BWN_PHYTYPE_AC)
3843 			filename = "ucode42";
3844 		break;
3845 	case 40:
3846 		if (mac->mac_phy.type == BWN_PHYTYPE_AC)
3847 			filename = "ucode40";
3848 		break;
3849 	case 33:
3850 		if (mac->mac_phy.type == BWN_PHYTYPE_LCN40)
3851 			filename = "ucode33_lcn40";
3852 		break;
3853 	case 30:
3854 		if (mac->mac_phy.type == BWN_PHYTYPE_N)
3855 			filename = "ucode30_mimo";
3856 		break;
3857 	case 29:
3858 		if (mac->mac_phy.type == BWN_PHYTYPE_HT)
3859 			filename = "ucode29_mimo";
3860 		break;
3861 	case 26:
3862 		if (mac->mac_phy.type == BWN_PHYTYPE_HT)
3863 			filename = "ucode26_mimo";
3864 		break;
3865 	case 28:
3866 	case 25:
3867 		if (mac->mac_phy.type == BWN_PHYTYPE_N)
3868 			filename = "ucode25_mimo";
3869 		else if (mac->mac_phy.type == BWN_PHYTYPE_LCN)
3870 			filename = "ucode25_lcn";
3871 		break;
3872 	case 24:
3873 		if (mac->mac_phy.type == BWN_PHYTYPE_LCN)
3874 			filename = "ucode24_lcn";
3875 		break;
3876 	case 23:
3877 		if (mac->mac_phy.type == BWN_PHYTYPE_N)
3878 			filename = "ucode16_mimo";
3879 		break;
3880 	case 16:
3881 	case 17:
3882 	case 18:
3883 	case 19:
3884 		if (mac->mac_phy.type == BWN_PHYTYPE_N)
3885 			filename = "ucode16_mimo";
3886 		else if (mac->mac_phy.type == BWN_PHYTYPE_LP)
3887 			filename = "ucode16_lp";
3888 		break;
3889 	case 15:
3890 		filename = "ucode15";
3891 		break;
3892 	case 14:
3893 		filename = "ucode14";
3894 		break;
3895 	case 13:
3896 		filename = "ucode13";
3897 		break;
3898 	case 12:
3899 	case 11:
3900 		filename = "ucode11";
3901 		break;
3902 	case 10:
3903 	case 9:
3904 	case 8:
3905 	case 7:
3906 	case 6:
3907 	case 5:
3908 		filename = "ucode5";
3909 		break;
3910 	default:
3911 		device_printf(sc->sc_dev, "no ucode for rev %d\n", rev);
3912 		bwn_release_firmware(mac);
3913 		return (EOPNOTSUPP);
3914 	}
3915 
3916 	device_printf(sc->sc_dev, "ucode fw: %s\n", filename);
3917 	error = bwn_fw_get(mac, type, filename, &fw->ucode);
3918 	if (error) {
3919 		bwn_release_firmware(mac);
3920 		return (error);
3921 	}
3922 
3923 	/* PCM */
3924 	KASSERT(fw->no_pcmfile == 0, ("%s:%d fail", __func__, __LINE__));
3925 	if (rev >= 5 && rev <= 10) {
3926 		error = bwn_fw_get(mac, type, "pcm5", &fw->pcm);
3927 		if (error == ENOENT)
3928 			fw->no_pcmfile = 1;
3929 		else if (error) {
3930 			bwn_release_firmware(mac);
3931 			return (error);
3932 		}
3933 	} else if (rev < 11) {
3934 		device_printf(sc->sc_dev, "no PCM for rev %d\n", rev);
3935 		bwn_release_firmware(mac);
3936 		return (EOPNOTSUPP);
3937 	}
3938 
3939 	/* initvals */
3940 	high = siba_read_4(sc->sc_dev, SIBA_TGSHIGH);
3941 	switch (mac->mac_phy.type) {
3942 	case BWN_PHYTYPE_A:
3943 		if (rev < 5 || rev > 10)
3944 			goto fail1;
3945 		if (high & BWN_TGSHIGH_HAVE_2GHZ)
3946 			filename = "a0g1initvals5";
3947 		else
3948 			filename = "a0g0initvals5";
3949 		break;
3950 	case BWN_PHYTYPE_G:
3951 		if (rev >= 5 && rev <= 10)
3952 			filename = "b0g0initvals5";
3953 		else if (rev >= 13)
3954 			filename = "b0g0initvals13";
3955 		else
3956 			goto fail1;
3957 		break;
3958 	case BWN_PHYTYPE_LP:
3959 		if (rev == 13)
3960 			filename = "lp0initvals13";
3961 		else if (rev == 14)
3962 			filename = "lp0initvals14";
3963 		else if (rev >= 15)
3964 			filename = "lp0initvals15";
3965 		else
3966 			goto fail1;
3967 		break;
3968 	case BWN_PHYTYPE_N:
3969 		if (rev == 30)
3970 			filename = "n16initvals30";
3971 		else if (rev == 28 || rev == 25)
3972 			filename = "n0initvals25";
3973 		else if (rev == 24)
3974 			filename = "n0initvals24";
3975 		else if (rev == 23)
3976 			filename = "n0initvals16";
3977 		else if (rev >= 16 && rev <= 18)
3978 			filename = "n0initvals16";
3979 		else if (rev >= 11 && rev <= 12)
3980 			filename = "n0initvals11";
3981 		else
3982 			goto fail1;
3983 		break;
3984 	default:
3985 		goto fail1;
3986 	}
3987 	error = bwn_fw_get(mac, type, filename, &fw->initvals);
3988 	if (error) {
3989 		bwn_release_firmware(mac);
3990 		return (error);
3991 	}
3992 
3993 	/* bandswitch initvals */
3994 	switch (mac->mac_phy.type) {
3995 	case BWN_PHYTYPE_A:
3996 		if (rev >= 5 && rev <= 10) {
3997 			if (high & BWN_TGSHIGH_HAVE_2GHZ)
3998 				filename = "a0g1bsinitvals5";
3999 			else
4000 				filename = "a0g0bsinitvals5";
4001 		} else if (rev >= 11)
4002 			filename = NULL;
4003 		else
4004 			goto fail1;
4005 		break;
4006 	case BWN_PHYTYPE_G:
4007 		if (rev >= 5 && rev <= 10)
4008 			filename = "b0g0bsinitvals5";
4009 		else if (rev >= 11)
4010 			filename = NULL;
4011 		else
4012 			goto fail1;
4013 		break;
4014 	case BWN_PHYTYPE_LP:
4015 		if (rev == 13)
4016 			filename = "lp0bsinitvals13";
4017 		else if (rev == 14)
4018 			filename = "lp0bsinitvals14";
4019 		else if (rev >= 15)
4020 			filename = "lp0bsinitvals15";
4021 		else
4022 			goto fail1;
4023 		break;
4024 	case BWN_PHYTYPE_N:
4025 		if (rev == 30)
4026 			filename = "n16bsinitvals30";
4027 		else if (rev == 28 || rev == 25)
4028 			filename = "n0bsinitvals25";
4029 		else if (rev == 24)
4030 			filename = "n0bsinitvals24";
4031 		else if (rev == 23)
4032 			filename = "n0bsinitvals16";
4033 		else if (rev >= 16 && rev <= 18)
4034 			filename = "n0bsinitvals16";
4035 		else if (rev >= 11 && rev <= 12)
4036 			filename = "n0bsinitvals11";
4037 		else
4038 			goto fail1;
4039 		break;
4040 	default:
4041 		device_printf(sc->sc_dev, "unknown phy (%d)\n",
4042 		    mac->mac_phy.type);
4043 		goto fail1;
4044 	}
4045 	error = bwn_fw_get(mac, type, filename, &fw->initvals_band);
4046 	if (error) {
4047 		bwn_release_firmware(mac);
4048 		return (error);
4049 	}
4050 	return (0);
4051 fail1:
4052 	device_printf(sc->sc_dev, "no INITVALS for rev %d, phy.type %d\n",
4053 	    rev, mac->mac_phy.type);
4054 	bwn_release_firmware(mac);
4055 	return (EOPNOTSUPP);
4056 }
4057 
4058 static int
4059 bwn_fw_get(struct bwn_mac *mac, enum bwn_fwtype type,
4060     const char *name, struct bwn_fwfile *bfw)
4061 {
4062 	const struct bwn_fwhdr *hdr;
4063 	struct bwn_softc *sc = mac->mac_sc;
4064 	const struct firmware *fw;
4065 	char namebuf[64];
4066 
4067 	if (name == NULL) {
4068 		bwn_do_release_fw(bfw);
4069 		return (0);
4070 	}
4071 	if (bfw->filename != NULL) {
4072 		if (bfw->type == type && (strcmp(bfw->filename, name) == 0))
4073 			return (0);
4074 		bwn_do_release_fw(bfw);
4075 	}
4076 
4077 	snprintf(namebuf, sizeof(namebuf), "bwn%s_v4_%s%s",
4078 	    (type == BWN_FWTYPE_OPENSOURCE) ? "-open" : "",
4079 	    (mac->mac_phy.type == BWN_PHYTYPE_LP) ? "lp_" : "", name);
4080 	/* XXX Sleeping on "fwload" with the non-sleepable locks held */
4081 	fw = firmware_get(namebuf);
4082 	if (fw == NULL) {
4083 		device_printf(sc->sc_dev, "the fw file(%s) not found\n",
4084 		    namebuf);
4085 		return (ENOENT);
4086 	}
4087 	if (fw->datasize < sizeof(struct bwn_fwhdr))
4088 		goto fail;
4089 	hdr = (const struct bwn_fwhdr *)(fw->data);
4090 	switch (hdr->type) {
4091 	case BWN_FWTYPE_UCODE:
4092 	case BWN_FWTYPE_PCM:
4093 		if (be32toh(hdr->size) !=
4094 		    (fw->datasize - sizeof(struct bwn_fwhdr)))
4095 			goto fail;
4096 		/* FALLTHROUGH */
4097 	case BWN_FWTYPE_IV:
4098 		if (hdr->ver != 1)
4099 			goto fail;
4100 		break;
4101 	default:
4102 		goto fail;
4103 	}
4104 	bfw->filename = name;
4105 	bfw->fw = fw;
4106 	bfw->type = type;
4107 	return (0);
4108 fail:
4109 	device_printf(sc->sc_dev, "the fw file(%s) format error\n", namebuf);
4110 	if (fw != NULL)
4111 		firmware_put(fw, FIRMWARE_UNLOAD);
4112 	return (EPROTO);
4113 }
4114 
4115 static void
4116 bwn_release_firmware(struct bwn_mac *mac)
4117 {
4118 
4119 	bwn_do_release_fw(&mac->mac_fw.ucode);
4120 	bwn_do_release_fw(&mac->mac_fw.pcm);
4121 	bwn_do_release_fw(&mac->mac_fw.initvals);
4122 	bwn_do_release_fw(&mac->mac_fw.initvals_band);
4123 }
4124 
4125 static void
4126 bwn_do_release_fw(struct bwn_fwfile *bfw)
4127 {
4128 
4129 	if (bfw->fw != NULL)
4130 		firmware_put(bfw->fw, FIRMWARE_UNLOAD);
4131 	bfw->fw = NULL;
4132 	bfw->filename = NULL;
4133 }
4134 
4135 static int
4136 bwn_fw_loaducode(struct bwn_mac *mac)
4137 {
4138 #define	GETFWOFFSET(fwp, offset)	\
4139 	((const uint32_t *)((const char *)fwp.fw->data + offset))
4140 #define	GETFWSIZE(fwp, offset)	\
4141 	((fwp.fw->datasize - offset) / sizeof(uint32_t))
4142 	struct bwn_softc *sc = mac->mac_sc;
4143 	const uint32_t *data;
4144 	unsigned int i;
4145 	uint32_t ctl;
4146 	uint16_t date, fwcaps, time;
4147 	int error = 0;
4148 
4149 	ctl = BWN_READ_4(mac, BWN_MACCTL);
4150 	ctl |= BWN_MACCTL_MCODE_JMP0;
4151 	KASSERT(!(ctl & BWN_MACCTL_MCODE_RUN), ("%s:%d: fail", __func__,
4152 	    __LINE__));
4153 	BWN_WRITE_4(mac, BWN_MACCTL, ctl);
4154 	for (i = 0; i < 64; i++)
4155 		bwn_shm_write_2(mac, BWN_SCRATCH, i, 0);
4156 	for (i = 0; i < 4096; i += 2)
4157 		bwn_shm_write_2(mac, BWN_SHARED, i, 0);
4158 
4159 	data = GETFWOFFSET(mac->mac_fw.ucode, sizeof(struct bwn_fwhdr));
4160 	bwn_shm_ctlword(mac, BWN_UCODE | BWN_SHARED_AUTOINC, 0x0000);
4161 	for (i = 0; i < GETFWSIZE(mac->mac_fw.ucode, sizeof(struct bwn_fwhdr));
4162 	     i++) {
4163 		BWN_WRITE_4(mac, BWN_SHM_DATA, be32toh(data[i]));
4164 		DELAY(10);
4165 	}
4166 
4167 	if (mac->mac_fw.pcm.fw) {
4168 		data = GETFWOFFSET(mac->mac_fw.pcm, sizeof(struct bwn_fwhdr));
4169 		bwn_shm_ctlword(mac, BWN_HW, 0x01ea);
4170 		BWN_WRITE_4(mac, BWN_SHM_DATA, 0x00004000);
4171 		bwn_shm_ctlword(mac, BWN_HW, 0x01eb);
4172 		for (i = 0; i < GETFWSIZE(mac->mac_fw.pcm,
4173 		    sizeof(struct bwn_fwhdr)); i++) {
4174 			BWN_WRITE_4(mac, BWN_SHM_DATA, be32toh(data[i]));
4175 			DELAY(10);
4176 		}
4177 	}
4178 
4179 	BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_ALL);
4180 	BWN_WRITE_4(mac, BWN_MACCTL,
4181 	    (BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_MCODE_JMP0) |
4182 	    BWN_MACCTL_MCODE_RUN);
4183 
4184 	for (i = 0; i < 21; i++) {
4185 		if (BWN_READ_4(mac, BWN_INTR_REASON) == BWN_INTR_MAC_SUSPENDED)
4186 			break;
4187 		if (i >= 20) {
4188 			device_printf(sc->sc_dev, "ucode timeout\n");
4189 			error = ENXIO;
4190 			goto error;
4191 		}
4192 		DELAY(50000);
4193 	}
4194 	BWN_READ_4(mac, BWN_INTR_REASON);
4195 
4196 	mac->mac_fw.rev = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_REV);
4197 	if (mac->mac_fw.rev <= 0x128) {
4198 		device_printf(sc->sc_dev, "the firmware is too old\n");
4199 		error = EOPNOTSUPP;
4200 		goto error;
4201 	}
4202 
4203 	/*
4204 	 * Determine firmware header version; needed for TX/RX packet
4205 	 * handling.
4206 	 */
4207 	if (mac->mac_fw.rev >= 598)
4208 		mac->mac_fw.fw_hdr_format = BWN_FW_HDR_598;
4209 	else if (mac->mac_fw.rev >= 410)
4210 		mac->mac_fw.fw_hdr_format = BWN_FW_HDR_410;
4211 	else
4212 		mac->mac_fw.fw_hdr_format = BWN_FW_HDR_351;
4213 
4214 	/*
4215 	 * We don't support rev 598 or later; that requires
4216 	 * another round of changes to the TX/RX descriptor
4217 	 * and status layout.
4218 	 *
4219 	 * So, complain this is the case and exit out, rather
4220 	 * than attaching and then failing.
4221 	 */
4222 #if 0
4223 	if (mac->mac_fw.fw_hdr_format == BWN_FW_HDR_598) {
4224 		device_printf(sc->sc_dev,
4225 		    "firmware is too new (>=598); not supported\n");
4226 		error = EOPNOTSUPP;
4227 		goto error;
4228 	}
4229 #endif
4230 
4231 	mac->mac_fw.patch = bwn_shm_read_2(mac, BWN_SHARED,
4232 	    BWN_SHARED_UCODE_PATCH);
4233 	date = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_DATE);
4234 	mac->mac_fw.opensource = (date == 0xffff);
4235 	if (bwn_wme != 0)
4236 		mac->mac_flags |= BWN_MAC_FLAG_WME;
4237 	mac->mac_flags |= BWN_MAC_FLAG_HWCRYPTO;
4238 
4239 	time = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_UCODE_TIME);
4240 	if (mac->mac_fw.opensource == 0) {
4241 		device_printf(sc->sc_dev,
4242 		    "firmware version (rev %u patch %u date %#x time %#x)\n",
4243 		    mac->mac_fw.rev, mac->mac_fw.patch, date, time);
4244 		if (mac->mac_fw.no_pcmfile)
4245 			device_printf(sc->sc_dev,
4246 			    "no HW crypto acceleration due to pcm5\n");
4247 	} else {
4248 		mac->mac_fw.patch = time;
4249 		fwcaps = bwn_fwcaps_read(mac);
4250 		if (!(fwcaps & BWN_FWCAPS_HWCRYPTO) || mac->mac_fw.no_pcmfile) {
4251 			device_printf(sc->sc_dev,
4252 			    "disabling HW crypto acceleration\n");
4253 			mac->mac_flags &= ~BWN_MAC_FLAG_HWCRYPTO;
4254 		}
4255 		if (!(fwcaps & BWN_FWCAPS_WME)) {
4256 			device_printf(sc->sc_dev, "disabling WME support\n");
4257 			mac->mac_flags &= ~BWN_MAC_FLAG_WME;
4258 		}
4259 	}
4260 
4261 	if (BWN_ISOLDFMT(mac))
4262 		device_printf(sc->sc_dev, "using old firmware image\n");
4263 
4264 	return (0);
4265 
4266 error:
4267 	BWN_WRITE_4(mac, BWN_MACCTL,
4268 	    (BWN_READ_4(mac, BWN_MACCTL) & ~BWN_MACCTL_MCODE_RUN) |
4269 	    BWN_MACCTL_MCODE_JMP0);
4270 
4271 	return (error);
4272 #undef GETFWSIZE
4273 #undef GETFWOFFSET
4274 }
4275 
4276 /* OpenFirmware only */
4277 static uint16_t
4278 bwn_fwcaps_read(struct bwn_mac *mac)
4279 {
4280 
4281 	KASSERT(mac->mac_fw.opensource == 1,
4282 	    ("%s:%d: fail", __func__, __LINE__));
4283 	return (bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_FWCAPS));
4284 }
4285 
4286 static int
4287 bwn_fwinitvals_write(struct bwn_mac *mac, const struct bwn_fwinitvals *ivals,
4288     size_t count, size_t array_size)
4289 {
4290 #define	GET_NEXTIV16(iv)						\
4291 	((const struct bwn_fwinitvals *)((const uint8_t *)(iv) +	\
4292 	    sizeof(uint16_t) + sizeof(uint16_t)))
4293 #define	GET_NEXTIV32(iv)						\
4294 	((const struct bwn_fwinitvals *)((const uint8_t *)(iv) +	\
4295 	    sizeof(uint16_t) + sizeof(uint32_t)))
4296 	struct bwn_softc *sc = mac->mac_sc;
4297 	const struct bwn_fwinitvals *iv;
4298 	uint16_t offset;
4299 	size_t i;
4300 	uint8_t bit32;
4301 
4302 	KASSERT(sizeof(struct bwn_fwinitvals) == 6,
4303 	    ("%s:%d: fail", __func__, __LINE__));
4304 	iv = ivals;
4305 	for (i = 0; i < count; i++) {
4306 		if (array_size < sizeof(iv->offset_size))
4307 			goto fail;
4308 		array_size -= sizeof(iv->offset_size);
4309 		offset = be16toh(iv->offset_size);
4310 		bit32 = (offset & BWN_FWINITVALS_32BIT) ? 1 : 0;
4311 		offset &= BWN_FWINITVALS_OFFSET_MASK;
4312 		if (offset >= 0x1000)
4313 			goto fail;
4314 		if (bit32) {
4315 			if (array_size < sizeof(iv->data.d32))
4316 				goto fail;
4317 			array_size -= sizeof(iv->data.d32);
4318 			BWN_WRITE_4(mac, offset, be32toh(iv->data.d32));
4319 			iv = GET_NEXTIV32(iv);
4320 		} else {
4321 
4322 			if (array_size < sizeof(iv->data.d16))
4323 				goto fail;
4324 			array_size -= sizeof(iv->data.d16);
4325 			BWN_WRITE_2(mac, offset, be16toh(iv->data.d16));
4326 
4327 			iv = GET_NEXTIV16(iv);
4328 		}
4329 	}
4330 	if (array_size != 0)
4331 		goto fail;
4332 	return (0);
4333 fail:
4334 	device_printf(sc->sc_dev, "initvals: invalid format\n");
4335 	return (EPROTO);
4336 #undef GET_NEXTIV16
4337 #undef GET_NEXTIV32
4338 }
4339 
4340 int
4341 bwn_switch_channel(struct bwn_mac *mac, int chan)
4342 {
4343 	struct bwn_phy *phy = &(mac->mac_phy);
4344 	struct bwn_softc *sc = mac->mac_sc;
4345 	struct ieee80211com *ic = &sc->sc_ic;
4346 	uint16_t channelcookie, savedcookie;
4347 	int error;
4348 
4349 	if (chan == 0xffff)
4350 		chan = phy->get_default_chan(mac);
4351 
4352 	channelcookie = chan;
4353 	if (IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan))
4354 		channelcookie |= 0x100;
4355 	savedcookie = bwn_shm_read_2(mac, BWN_SHARED, BWN_SHARED_CHAN);
4356 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_CHAN, channelcookie);
4357 	error = phy->switch_channel(mac, chan);
4358 	if (error)
4359 		goto fail;
4360 
4361 	mac->mac_phy.chan = chan;
4362 	DELAY(8000);
4363 	return (0);
4364 fail:
4365 	device_printf(sc->sc_dev, "failed to switch channel\n");
4366 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_CHAN, savedcookie);
4367 	return (error);
4368 }
4369 
4370 static uint16_t
4371 bwn_ant2phy(int antenna)
4372 {
4373 
4374 	switch (antenna) {
4375 	case BWN_ANT0:
4376 		return (BWN_TX_PHY_ANT0);
4377 	case BWN_ANT1:
4378 		return (BWN_TX_PHY_ANT1);
4379 	case BWN_ANT2:
4380 		return (BWN_TX_PHY_ANT2);
4381 	case BWN_ANT3:
4382 		return (BWN_TX_PHY_ANT3);
4383 	case BWN_ANTAUTO:
4384 		return (BWN_TX_PHY_ANT01AUTO);
4385 	}
4386 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
4387 	return (0);
4388 }
4389 
4390 static void
4391 bwn_wme_load(struct bwn_mac *mac)
4392 {
4393 	struct bwn_softc *sc = mac->mac_sc;
4394 	int i;
4395 
4396 	KASSERT(N(bwn_wme_shm_offsets) == N(sc->sc_wmeParams),
4397 	    ("%s:%d: fail", __func__, __LINE__));
4398 
4399 	bwn_mac_suspend(mac);
4400 	for (i = 0; i < N(sc->sc_wmeParams); i++)
4401 		bwn_wme_loadparams(mac, &(sc->sc_wmeParams[i]),
4402 		    bwn_wme_shm_offsets[i]);
4403 	bwn_mac_enable(mac);
4404 }
4405 
4406 static void
4407 bwn_wme_loadparams(struct bwn_mac *mac,
4408     const struct wmeParams *p, uint16_t shm_offset)
4409 {
4410 #define	SM(_v, _f)      (((_v) << _f##_S) & _f)
4411 	struct bwn_softc *sc = mac->mac_sc;
4412 	uint16_t params[BWN_NR_WMEPARAMS];
4413 	int slot, tmp;
4414 	unsigned int i;
4415 
4416 	slot = BWN_READ_2(mac, BWN_RNG) &
4417 	    SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4418 
4419 	memset(&params, 0, sizeof(params));
4420 
4421 	DPRINTF(sc, BWN_DEBUG_WME, "wmep_txopLimit %d wmep_logcwmin %d "
4422 	    "wmep_logcwmax %d wmep_aifsn %d\n", p->wmep_txopLimit,
4423 	    p->wmep_logcwmin, p->wmep_logcwmax, p->wmep_aifsn);
4424 
4425 	params[BWN_WMEPARAM_TXOP] = p->wmep_txopLimit * 32;
4426 	params[BWN_WMEPARAM_CWMIN] = SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4427 	params[BWN_WMEPARAM_CWMAX] = SM(p->wmep_logcwmax, WME_PARAM_LOGCWMAX);
4428 	params[BWN_WMEPARAM_CWCUR] = SM(p->wmep_logcwmin, WME_PARAM_LOGCWMIN);
4429 	params[BWN_WMEPARAM_AIFS] = p->wmep_aifsn;
4430 	params[BWN_WMEPARAM_BSLOTS] = slot;
4431 	params[BWN_WMEPARAM_REGGAP] = slot + p->wmep_aifsn;
4432 
4433 	for (i = 0; i < N(params); i++) {
4434 		if (i == BWN_WMEPARAM_STATUS) {
4435 			tmp = bwn_shm_read_2(mac, BWN_SHARED,
4436 			    shm_offset + (i * 2));
4437 			tmp |= 0x100;
4438 			bwn_shm_write_2(mac, BWN_SHARED, shm_offset + (i * 2),
4439 			    tmp);
4440 		} else {
4441 			bwn_shm_write_2(mac, BWN_SHARED, shm_offset + (i * 2),
4442 			    params[i]);
4443 		}
4444 	}
4445 }
4446 
4447 static void
4448 bwn_mac_write_bssid(struct bwn_mac *mac)
4449 {
4450 	struct bwn_softc *sc = mac->mac_sc;
4451 	uint32_t tmp;
4452 	int i;
4453 	uint8_t mac_bssid[IEEE80211_ADDR_LEN * 2];
4454 
4455 	bwn_mac_setfilter(mac, BWN_MACFILTER_BSSID, sc->sc_bssid);
4456 	memcpy(mac_bssid, sc->sc_ic.ic_macaddr, IEEE80211_ADDR_LEN);
4457 	memcpy(mac_bssid + IEEE80211_ADDR_LEN, sc->sc_bssid,
4458 	    IEEE80211_ADDR_LEN);
4459 
4460 	for (i = 0; i < N(mac_bssid); i += sizeof(uint32_t)) {
4461 		tmp = (uint32_t) (mac_bssid[i + 0]);
4462 		tmp |= (uint32_t) (mac_bssid[i + 1]) << 8;
4463 		tmp |= (uint32_t) (mac_bssid[i + 2]) << 16;
4464 		tmp |= (uint32_t) (mac_bssid[i + 3]) << 24;
4465 		bwn_ram_write(mac, 0x20 + i, tmp);
4466 	}
4467 }
4468 
4469 static void
4470 bwn_mac_setfilter(struct bwn_mac *mac, uint16_t offset,
4471     const uint8_t *macaddr)
4472 {
4473 	static const uint8_t zero[IEEE80211_ADDR_LEN] = { 0 };
4474 	uint16_t data;
4475 
4476 	if (!mac)
4477 		macaddr = zero;
4478 
4479 	offset |= 0x0020;
4480 	BWN_WRITE_2(mac, BWN_MACFILTER_CONTROL, offset);
4481 
4482 	data = macaddr[0];
4483 	data |= macaddr[1] << 8;
4484 	BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4485 	data = macaddr[2];
4486 	data |= macaddr[3] << 8;
4487 	BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4488 	data = macaddr[4];
4489 	data |= macaddr[5] << 8;
4490 	BWN_WRITE_2(mac, BWN_MACFILTER_DATA, data);
4491 }
4492 
4493 static void
4494 bwn_key_dowrite(struct bwn_mac *mac, uint8_t index, uint8_t algorithm,
4495     const uint8_t *key, size_t key_len, const uint8_t *mac_addr)
4496 {
4497 	uint8_t buf[BWN_SEC_KEYSIZE] = { 0, };
4498 	uint8_t per_sta_keys_start = 8;
4499 
4500 	if (BWN_SEC_NEWAPI(mac))
4501 		per_sta_keys_start = 4;
4502 
4503 	KASSERT(index < mac->mac_max_nr_keys,
4504 	    ("%s:%d: fail", __func__, __LINE__));
4505 	KASSERT(key_len <= BWN_SEC_KEYSIZE,
4506 	    ("%s:%d: fail", __func__, __LINE__));
4507 
4508 	if (index >= per_sta_keys_start)
4509 		bwn_key_macwrite(mac, index, NULL);
4510 	if (key)
4511 		memcpy(buf, key, key_len);
4512 	bwn_key_write(mac, index, algorithm, buf);
4513 	if (index >= per_sta_keys_start)
4514 		bwn_key_macwrite(mac, index, mac_addr);
4515 
4516 	mac->mac_key[index].algorithm = algorithm;
4517 }
4518 
4519 static void
4520 bwn_key_macwrite(struct bwn_mac *mac, uint8_t index, const uint8_t *addr)
4521 {
4522 	struct bwn_softc *sc = mac->mac_sc;
4523 	uint32_t addrtmp[2] = { 0, 0 };
4524 	uint8_t start = 8;
4525 
4526 	if (BWN_SEC_NEWAPI(mac))
4527 		start = 4;
4528 
4529 	KASSERT(index >= start,
4530 	    ("%s:%d: fail", __func__, __LINE__));
4531 	index -= start;
4532 
4533 	if (addr) {
4534 		addrtmp[0] = addr[0];
4535 		addrtmp[0] |= ((uint32_t) (addr[1]) << 8);
4536 		addrtmp[0] |= ((uint32_t) (addr[2]) << 16);
4537 		addrtmp[0] |= ((uint32_t) (addr[3]) << 24);
4538 		addrtmp[1] = addr[4];
4539 		addrtmp[1] |= ((uint32_t) (addr[5]) << 8);
4540 	}
4541 
4542 	if (siba_get_revid(sc->sc_dev) >= 5) {
4543 		bwn_shm_write_4(mac, BWN_RCMTA, (index * 2) + 0, addrtmp[0]);
4544 		bwn_shm_write_2(mac, BWN_RCMTA, (index * 2) + 1, addrtmp[1]);
4545 	} else {
4546 		if (index >= 8) {
4547 			bwn_shm_write_4(mac, BWN_SHARED,
4548 			    BWN_SHARED_PSM + (index * 6) + 0, addrtmp[0]);
4549 			bwn_shm_write_2(mac, BWN_SHARED,
4550 			    BWN_SHARED_PSM + (index * 6) + 4, addrtmp[1]);
4551 		}
4552 	}
4553 }
4554 
4555 static void
4556 bwn_key_write(struct bwn_mac *mac, uint8_t index, uint8_t algorithm,
4557     const uint8_t *key)
4558 {
4559 	unsigned int i;
4560 	uint32_t offset;
4561 	uint16_t kidx, value;
4562 
4563 	kidx = BWN_SEC_KEY2FW(mac, index);
4564 	bwn_shm_write_2(mac, BWN_SHARED,
4565 	    BWN_SHARED_KEYIDX_BLOCK + (kidx * 2), (kidx << 4) | algorithm);
4566 
4567 	offset = mac->mac_ktp + (index * BWN_SEC_KEYSIZE);
4568 	for (i = 0; i < BWN_SEC_KEYSIZE; i += 2) {
4569 		value = key[i];
4570 		value |= (uint16_t)(key[i + 1]) << 8;
4571 		bwn_shm_write_2(mac, BWN_SHARED, offset + i, value);
4572 	}
4573 }
4574 
4575 static void
4576 bwn_phy_exit(struct bwn_mac *mac)
4577 {
4578 
4579 	mac->mac_phy.rf_onoff(mac, 0);
4580 	if (mac->mac_phy.exit != NULL)
4581 		mac->mac_phy.exit(mac);
4582 }
4583 
4584 static void
4585 bwn_dma_free(struct bwn_mac *mac)
4586 {
4587 	struct bwn_dma *dma;
4588 
4589 	if ((mac->mac_flags & BWN_MAC_FLAG_DMA) == 0)
4590 		return;
4591 	dma = &mac->mac_method.dma;
4592 
4593 	bwn_dma_ringfree(&dma->rx);
4594 	bwn_dma_ringfree(&dma->wme[WME_AC_BK]);
4595 	bwn_dma_ringfree(&dma->wme[WME_AC_BE]);
4596 	bwn_dma_ringfree(&dma->wme[WME_AC_VI]);
4597 	bwn_dma_ringfree(&dma->wme[WME_AC_VO]);
4598 	bwn_dma_ringfree(&dma->mcast);
4599 }
4600 
4601 static void
4602 bwn_core_stop(struct bwn_mac *mac)
4603 {
4604 	struct bwn_softc *sc = mac->mac_sc;
4605 
4606 	BWN_ASSERT_LOCKED(sc);
4607 
4608 	if (mac->mac_status < BWN_MAC_STATUS_STARTED)
4609 		return;
4610 
4611 	callout_stop(&sc->sc_rfswitch_ch);
4612 	callout_stop(&sc->sc_task_ch);
4613 	callout_stop(&sc->sc_watchdog_ch);
4614 	sc->sc_watchdog_timer = 0;
4615 	BWN_WRITE_4(mac, BWN_INTR_MASK, 0);
4616 	BWN_READ_4(mac, BWN_INTR_MASK);
4617 	bwn_mac_suspend(mac);
4618 
4619 	mac->mac_status = BWN_MAC_STATUS_INITED;
4620 }
4621 
4622 static int
4623 bwn_switch_band(struct bwn_softc *sc, struct ieee80211_channel *chan)
4624 {
4625 	struct bwn_mac *up_dev = NULL;
4626 	struct bwn_mac *down_dev;
4627 	struct bwn_mac *mac;
4628 	int err, status;
4629 	uint8_t gmode;
4630 
4631 	BWN_ASSERT_LOCKED(sc);
4632 
4633 	TAILQ_FOREACH(mac, &sc->sc_maclist, mac_list) {
4634 		if (IEEE80211_IS_CHAN_2GHZ(chan) &&
4635 		    mac->mac_phy.supports_2ghz) {
4636 			up_dev = mac;
4637 			gmode = 1;
4638 		} else if (IEEE80211_IS_CHAN_5GHZ(chan) &&
4639 		    mac->mac_phy.supports_5ghz) {
4640 			up_dev = mac;
4641 			gmode = 0;
4642 		} else {
4643 			KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
4644 			return (EINVAL);
4645 		}
4646 		if (up_dev != NULL)
4647 			break;
4648 	}
4649 	if (up_dev == NULL) {
4650 		device_printf(sc->sc_dev, "Could not find a device\n");
4651 		return (ENODEV);
4652 	}
4653 	if (up_dev == sc->sc_curmac && sc->sc_curmac->mac_phy.gmode == gmode)
4654 		return (0);
4655 
4656 	DPRINTF(sc, BWN_DEBUG_RF | BWN_DEBUG_PHY | BWN_DEBUG_RESET,
4657 	    "switching to %s-GHz band\n",
4658 	    IEEE80211_IS_CHAN_2GHZ(chan) ? "2" : "5");
4659 
4660 	down_dev = sc->sc_curmac;
4661 	status = down_dev->mac_status;
4662 	if (status >= BWN_MAC_STATUS_STARTED)
4663 		bwn_core_stop(down_dev);
4664 	if (status >= BWN_MAC_STATUS_INITED)
4665 		bwn_core_exit(down_dev);
4666 
4667 	if (down_dev != up_dev)
4668 		bwn_phy_reset(down_dev);
4669 
4670 	up_dev->mac_phy.gmode = gmode;
4671 	if (status >= BWN_MAC_STATUS_INITED) {
4672 		err = bwn_core_init(up_dev);
4673 		if (err) {
4674 			device_printf(sc->sc_dev,
4675 			    "fatal: failed to initialize for %s-GHz\n",
4676 			    IEEE80211_IS_CHAN_2GHZ(chan) ? "2" : "5");
4677 			goto fail;
4678 		}
4679 	}
4680 	if (status >= BWN_MAC_STATUS_STARTED)
4681 		bwn_core_start(up_dev);
4682 	KASSERT(up_dev->mac_status == status, ("%s: fail", __func__));
4683 	sc->sc_curmac = up_dev;
4684 
4685 	return (0);
4686 fail:
4687 	sc->sc_curmac = NULL;
4688 	return (err);
4689 }
4690 
4691 static void
4692 bwn_rf_turnon(struct bwn_mac *mac)
4693 {
4694 
4695 	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
4696 
4697 	bwn_mac_suspend(mac);
4698 	mac->mac_phy.rf_onoff(mac, 1);
4699 	mac->mac_phy.rf_on = 1;
4700 	bwn_mac_enable(mac);
4701 }
4702 
4703 static void
4704 bwn_rf_turnoff(struct bwn_mac *mac)
4705 {
4706 
4707 	DPRINTF(mac->mac_sc, BWN_DEBUG_RESET, "%s: called\n", __func__);
4708 
4709 	bwn_mac_suspend(mac);
4710 	mac->mac_phy.rf_onoff(mac, 0);
4711 	mac->mac_phy.rf_on = 0;
4712 	bwn_mac_enable(mac);
4713 }
4714 
4715 /*
4716  * SSB PHY reset.
4717  */
4718 static void
4719 bwn_phy_reset_siba(struct bwn_mac *mac)
4720 {
4721 	struct bwn_softc *sc = mac->mac_sc;
4722 
4723 	siba_write_4(sc->sc_dev, SIBA_TGSLOW,
4724 	    ((siba_read_4(sc->sc_dev, SIBA_TGSLOW) & ~BWN_TGSLOW_SUPPORT_G) |
4725 	     BWN_TGSLOW_PHYRESET) | SIBA_TGSLOW_FGC);
4726 	DELAY(1000);
4727 	siba_write_4(sc->sc_dev, SIBA_TGSLOW,
4728 	    (siba_read_4(sc->sc_dev, SIBA_TGSLOW) & ~SIBA_TGSLOW_FGC));
4729 	DELAY(1000);
4730 }
4731 
4732 static void
4733 bwn_phy_reset(struct bwn_mac *mac)
4734 {
4735 
4736 	if (bwn_is_bus_siba(mac)) {
4737 		bwn_phy_reset_siba(mac);
4738 	} else {
4739 		BWN_ERRPRINTF(mac->mac_sc, "%s: unknown bus!\n", __func__);
4740 	}
4741 }
4742 
4743 static int
4744 bwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
4745 {
4746 	struct bwn_vap *bvp = BWN_VAP(vap);
4747 	struct ieee80211com *ic= vap->iv_ic;
4748 	enum ieee80211_state ostate = vap->iv_state;
4749 	struct bwn_softc *sc = ic->ic_softc;
4750 	struct bwn_mac *mac = sc->sc_curmac;
4751 	int error;
4752 
4753 	DPRINTF(sc, BWN_DEBUG_STATE, "%s: %s -> %s\n", __func__,
4754 	    ieee80211_state_name[vap->iv_state],
4755 	    ieee80211_state_name[nstate]);
4756 
4757 	error = bvp->bv_newstate(vap, nstate, arg);
4758 	if (error != 0)
4759 		return (error);
4760 
4761 	BWN_LOCK(sc);
4762 
4763 	bwn_led_newstate(mac, nstate);
4764 
4765 	/*
4766 	 * Clear the BSSID when we stop a STA
4767 	 */
4768 	if (vap->iv_opmode == IEEE80211_M_STA) {
4769 		if (ostate == IEEE80211_S_RUN && nstate != IEEE80211_S_RUN) {
4770 			/*
4771 			 * Clear out the BSSID.  If we reassociate to
4772 			 * the same AP, this will reinialize things
4773 			 * correctly...
4774 			 */
4775 			if (ic->ic_opmode == IEEE80211_M_STA &&
4776 			    (sc->sc_flags & BWN_FLAG_INVALID) == 0) {
4777 				memset(sc->sc_bssid, 0, IEEE80211_ADDR_LEN);
4778 				bwn_set_macaddr(mac);
4779 			}
4780 		}
4781 	}
4782 
4783 	if (vap->iv_opmode == IEEE80211_M_MONITOR ||
4784 	    vap->iv_opmode == IEEE80211_M_AHDEMO) {
4785 		/* XXX nothing to do? */
4786 	} else if (nstate == IEEE80211_S_RUN) {
4787 		memcpy(sc->sc_bssid, vap->iv_bss->ni_bssid, IEEE80211_ADDR_LEN);
4788 		bwn_set_opmode(mac);
4789 		bwn_set_pretbtt(mac);
4790 		bwn_spu_setdelay(mac, 0);
4791 		bwn_set_macaddr(mac);
4792 	}
4793 
4794 	BWN_UNLOCK(sc);
4795 
4796 	return (error);
4797 }
4798 
4799 static void
4800 bwn_set_pretbtt(struct bwn_mac *mac)
4801 {
4802 	struct bwn_softc *sc = mac->mac_sc;
4803 	struct ieee80211com *ic = &sc->sc_ic;
4804 	uint16_t pretbtt;
4805 
4806 	if (ic->ic_opmode == IEEE80211_M_IBSS)
4807 		pretbtt = 2;
4808 	else
4809 		pretbtt = (mac->mac_phy.type == BWN_PHYTYPE_A) ? 120 : 250;
4810 	bwn_shm_write_2(mac, BWN_SHARED, BWN_SHARED_PRETBTT, pretbtt);
4811 	BWN_WRITE_2(mac, BWN_TSF_CFP_PRETBTT, pretbtt);
4812 }
4813 
4814 static int
4815 bwn_intr(void *arg)
4816 {
4817 	struct bwn_mac *mac = arg;
4818 	struct bwn_softc *sc = mac->mac_sc;
4819 	uint32_t reason;
4820 
4821 	if (mac->mac_status < BWN_MAC_STATUS_STARTED ||
4822 	    (sc->sc_flags & BWN_FLAG_INVALID))
4823 		return (FILTER_STRAY);
4824 
4825 	DPRINTF(sc, BWN_DEBUG_INTR, "%s: called\n", __func__);
4826 
4827 	reason = BWN_READ_4(mac, BWN_INTR_REASON);
4828 	if (reason == 0xffffffff)	/* shared IRQ */
4829 		return (FILTER_STRAY);
4830 	reason &= mac->mac_intr_mask;
4831 	if (reason == 0)
4832 		return (FILTER_HANDLED);
4833 	DPRINTF(sc, BWN_DEBUG_INTR, "%s: reason=0x%08x\n", __func__, reason);
4834 
4835 	mac->mac_reason[0] = BWN_READ_4(mac, BWN_DMA0_REASON) & 0x0001dc00;
4836 	mac->mac_reason[1] = BWN_READ_4(mac, BWN_DMA1_REASON) & 0x0000dc00;
4837 	mac->mac_reason[2] = BWN_READ_4(mac, BWN_DMA2_REASON) & 0x0000dc00;
4838 	mac->mac_reason[3] = BWN_READ_4(mac, BWN_DMA3_REASON) & 0x0001dc00;
4839 	mac->mac_reason[4] = BWN_READ_4(mac, BWN_DMA4_REASON) & 0x0000dc00;
4840 	BWN_WRITE_4(mac, BWN_INTR_REASON, reason);
4841 	BWN_WRITE_4(mac, BWN_DMA0_REASON, mac->mac_reason[0]);
4842 	BWN_WRITE_4(mac, BWN_DMA1_REASON, mac->mac_reason[1]);
4843 	BWN_WRITE_4(mac, BWN_DMA2_REASON, mac->mac_reason[2]);
4844 	BWN_WRITE_4(mac, BWN_DMA3_REASON, mac->mac_reason[3]);
4845 	BWN_WRITE_4(mac, BWN_DMA4_REASON, mac->mac_reason[4]);
4846 
4847 	/* Disable interrupts. */
4848 	BWN_WRITE_4(mac, BWN_INTR_MASK, 0);
4849 
4850 	mac->mac_reason_intr = reason;
4851 
4852 	BWN_BARRIER(mac, BUS_SPACE_BARRIER_READ);
4853 	BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
4854 
4855 	taskqueue_enqueue(sc->sc_tq, &mac->mac_intrtask);
4856 	return (FILTER_HANDLED);
4857 }
4858 
4859 static void
4860 bwn_intrtask(void *arg, int npending)
4861 {
4862 	struct bwn_mac *mac = arg;
4863 	struct bwn_softc *sc = mac->mac_sc;
4864 	uint32_t merged = 0;
4865 	int i, tx = 0, rx = 0;
4866 
4867 	BWN_LOCK(sc);
4868 	if (mac->mac_status < BWN_MAC_STATUS_STARTED ||
4869 	    (sc->sc_flags & BWN_FLAG_INVALID)) {
4870 		BWN_UNLOCK(sc);
4871 		return;
4872 	}
4873 
4874 	for (i = 0; i < N(mac->mac_reason); i++)
4875 		merged |= mac->mac_reason[i];
4876 
4877 	if (mac->mac_reason_intr & BWN_INTR_MAC_TXERR)
4878 		device_printf(sc->sc_dev, "MAC trans error\n");
4879 
4880 	if (mac->mac_reason_intr & BWN_INTR_PHY_TXERR) {
4881 		DPRINTF(sc, BWN_DEBUG_INTR, "%s: PHY trans error\n", __func__);
4882 		mac->mac_phy.txerrors--;
4883 		if (mac->mac_phy.txerrors == 0) {
4884 			mac->mac_phy.txerrors = BWN_TXERROR_MAX;
4885 			bwn_restart(mac, "PHY TX errors");
4886 		}
4887 	}
4888 
4889 	if (merged & (BWN_DMAINTR_FATALMASK | BWN_DMAINTR_NONFATALMASK)) {
4890 		if (merged & BWN_DMAINTR_FATALMASK) {
4891 			device_printf(sc->sc_dev,
4892 			    "Fatal DMA error: %#x %#x %#x %#x %#x %#x\n",
4893 			    mac->mac_reason[0], mac->mac_reason[1],
4894 			    mac->mac_reason[2], mac->mac_reason[3],
4895 			    mac->mac_reason[4], mac->mac_reason[5]);
4896 			bwn_restart(mac, "DMA error");
4897 			BWN_UNLOCK(sc);
4898 			return;
4899 		}
4900 		if (merged & BWN_DMAINTR_NONFATALMASK) {
4901 			device_printf(sc->sc_dev,
4902 			    "DMA error: %#x %#x %#x %#x %#x %#x\n",
4903 			    mac->mac_reason[0], mac->mac_reason[1],
4904 			    mac->mac_reason[2], mac->mac_reason[3],
4905 			    mac->mac_reason[4], mac->mac_reason[5]);
4906 		}
4907 	}
4908 
4909 	if (mac->mac_reason_intr & BWN_INTR_UCODE_DEBUG)
4910 		bwn_intr_ucode_debug(mac);
4911 	if (mac->mac_reason_intr & BWN_INTR_TBTT_INDI)
4912 		bwn_intr_tbtt_indication(mac);
4913 	if (mac->mac_reason_intr & BWN_INTR_ATIM_END)
4914 		bwn_intr_atim_end(mac);
4915 	if (mac->mac_reason_intr & BWN_INTR_BEACON)
4916 		bwn_intr_beacon(mac);
4917 	if (mac->mac_reason_intr & BWN_INTR_PMQ)
4918 		bwn_intr_pmq(mac);
4919 	if (mac->mac_reason_intr & BWN_INTR_NOISESAMPLE_OK)
4920 		bwn_intr_noise(mac);
4921 
4922 	if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
4923 		if (mac->mac_reason[0] & BWN_DMAINTR_RX_DONE) {
4924 			bwn_dma_rx(mac->mac_method.dma.rx);
4925 			rx = 1;
4926 		}
4927 	} else
4928 		rx = bwn_pio_rx(&mac->mac_method.pio.rx);
4929 
4930 	KASSERT(!(mac->mac_reason[1] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4931 	KASSERT(!(mac->mac_reason[2] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4932 	KASSERT(!(mac->mac_reason[3] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4933 	KASSERT(!(mac->mac_reason[4] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4934 	KASSERT(!(mac->mac_reason[5] & BWN_DMAINTR_RX_DONE), ("%s", __func__));
4935 
4936 	if (mac->mac_reason_intr & BWN_INTR_TX_OK) {
4937 		bwn_intr_txeof(mac);
4938 		tx = 1;
4939 	}
4940 
4941 	BWN_WRITE_4(mac, BWN_INTR_MASK, mac->mac_intr_mask);
4942 
4943 	if (sc->sc_blink_led != NULL && sc->sc_led_blink) {
4944 		int evt = BWN_LED_EVENT_NONE;
4945 
4946 		if (tx && rx) {
4947 			if (sc->sc_rx_rate > sc->sc_tx_rate)
4948 				evt = BWN_LED_EVENT_RX;
4949 			else
4950 				evt = BWN_LED_EVENT_TX;
4951 		} else if (tx) {
4952 			evt = BWN_LED_EVENT_TX;
4953 		} else if (rx) {
4954 			evt = BWN_LED_EVENT_RX;
4955 		} else if (rx == 0) {
4956 			evt = BWN_LED_EVENT_POLL;
4957 		}
4958 
4959 		if (evt != BWN_LED_EVENT_NONE)
4960 			bwn_led_event(mac, evt);
4961        }
4962 
4963 	if (mbufq_first(&sc->sc_snd) != NULL)
4964 		bwn_start(sc);
4965 
4966 	BWN_BARRIER(mac, BUS_SPACE_BARRIER_READ);
4967 	BWN_BARRIER(mac, BUS_SPACE_BARRIER_WRITE);
4968 
4969 	BWN_UNLOCK(sc);
4970 }
4971 
4972 static void
4973 bwn_restart(struct bwn_mac *mac, const char *msg)
4974 {
4975 	struct bwn_softc *sc = mac->mac_sc;
4976 	struct ieee80211com *ic = &sc->sc_ic;
4977 
4978 	if (mac->mac_status < BWN_MAC_STATUS_INITED)
4979 		return;
4980 
4981 	device_printf(sc->sc_dev, "HW reset: %s\n", msg);
4982 	ieee80211_runtask(ic, &mac->mac_hwreset);
4983 }
4984 
4985 static void
4986 bwn_intr_ucode_debug(struct bwn_mac *mac)
4987 {
4988 	struct bwn_softc *sc = mac->mac_sc;
4989 	uint16_t reason;
4990 
4991 	if (mac->mac_fw.opensource == 0)
4992 		return;
4993 
4994 	reason = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_DEBUGINTR_REASON_REG);
4995 	switch (reason) {
4996 	case BWN_DEBUGINTR_PANIC:
4997 		bwn_handle_fwpanic(mac);
4998 		break;
4999 	case BWN_DEBUGINTR_DUMP_SHM:
5000 		device_printf(sc->sc_dev, "BWN_DEBUGINTR_DUMP_SHM\n");
5001 		break;
5002 	case BWN_DEBUGINTR_DUMP_REGS:
5003 		device_printf(sc->sc_dev, "BWN_DEBUGINTR_DUMP_REGS\n");
5004 		break;
5005 	case BWN_DEBUGINTR_MARKER:
5006 		device_printf(sc->sc_dev, "BWN_DEBUGINTR_MARKER\n");
5007 		break;
5008 	default:
5009 		device_printf(sc->sc_dev,
5010 		    "ucode debug unknown reason: %#x\n", reason);
5011 	}
5012 
5013 	bwn_shm_write_2(mac, BWN_SCRATCH, BWN_DEBUGINTR_REASON_REG,
5014 	    BWN_DEBUGINTR_ACK);
5015 }
5016 
5017 static void
5018 bwn_intr_tbtt_indication(struct bwn_mac *mac)
5019 {
5020 	struct bwn_softc *sc = mac->mac_sc;
5021 	struct ieee80211com *ic = &sc->sc_ic;
5022 
5023 	if (ic->ic_opmode != IEEE80211_M_HOSTAP)
5024 		bwn_psctl(mac, 0);
5025 	if (ic->ic_opmode == IEEE80211_M_IBSS)
5026 		mac->mac_flags |= BWN_MAC_FLAG_DFQVALID;
5027 }
5028 
5029 static void
5030 bwn_intr_atim_end(struct bwn_mac *mac)
5031 {
5032 
5033 	if (mac->mac_flags & BWN_MAC_FLAG_DFQVALID) {
5034 		BWN_WRITE_4(mac, BWN_MACCMD,
5035 		    BWN_READ_4(mac, BWN_MACCMD) | BWN_MACCMD_DFQ_VALID);
5036 		mac->mac_flags &= ~BWN_MAC_FLAG_DFQVALID;
5037 	}
5038 }
5039 
5040 static void
5041 bwn_intr_beacon(struct bwn_mac *mac)
5042 {
5043 	struct bwn_softc *sc = mac->mac_sc;
5044 	struct ieee80211com *ic = &sc->sc_ic;
5045 	uint32_t cmd, beacon0, beacon1;
5046 
5047 	if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
5048 	    ic->ic_opmode == IEEE80211_M_MBSS)
5049 		return;
5050 
5051 	mac->mac_intr_mask &= ~BWN_INTR_BEACON;
5052 
5053 	cmd = BWN_READ_4(mac, BWN_MACCMD);
5054 	beacon0 = (cmd & BWN_MACCMD_BEACON0_VALID);
5055 	beacon1 = (cmd & BWN_MACCMD_BEACON1_VALID);
5056 
5057 	if (beacon0 && beacon1) {
5058 		BWN_WRITE_4(mac, BWN_INTR_REASON, BWN_INTR_BEACON);
5059 		mac->mac_intr_mask |= BWN_INTR_BEACON;
5060 		return;
5061 	}
5062 
5063 	if (sc->sc_flags & BWN_FLAG_NEED_BEACON_TP) {
5064 		sc->sc_flags &= ~BWN_FLAG_NEED_BEACON_TP;
5065 		bwn_load_beacon0(mac);
5066 		bwn_load_beacon1(mac);
5067 		cmd = BWN_READ_4(mac, BWN_MACCMD);
5068 		cmd |= BWN_MACCMD_BEACON0_VALID;
5069 		BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5070 	} else {
5071 		if (!beacon0) {
5072 			bwn_load_beacon0(mac);
5073 			cmd = BWN_READ_4(mac, BWN_MACCMD);
5074 			cmd |= BWN_MACCMD_BEACON0_VALID;
5075 			BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5076 		} else if (!beacon1) {
5077 			bwn_load_beacon1(mac);
5078 			cmd = BWN_READ_4(mac, BWN_MACCMD);
5079 			cmd |= BWN_MACCMD_BEACON1_VALID;
5080 			BWN_WRITE_4(mac, BWN_MACCMD, cmd);
5081 		}
5082 	}
5083 }
5084 
5085 static void
5086 bwn_intr_pmq(struct bwn_mac *mac)
5087 {
5088 	uint32_t tmp;
5089 
5090 	while (1) {
5091 		tmp = BWN_READ_4(mac, BWN_PS_STATUS);
5092 		if (!(tmp & 0x00000008))
5093 			break;
5094 	}
5095 	BWN_WRITE_2(mac, BWN_PS_STATUS, 0x0002);
5096 }
5097 
5098 static void
5099 bwn_intr_noise(struct bwn_mac *mac)
5100 {
5101 	struct bwn_phy_g *pg = &mac->mac_phy.phy_g;
5102 	uint16_t tmp;
5103 	uint8_t noise[4];
5104 	uint8_t i, j;
5105 	int32_t average;
5106 
5107 	if (mac->mac_phy.type != BWN_PHYTYPE_G)
5108 		return;
5109 
5110 	KASSERT(mac->mac_noise.noi_running, ("%s: fail", __func__));
5111 	*((uint32_t *)noise) = htole32(bwn_jssi_read(mac));
5112 	if (noise[0] == 0x7f || noise[1] == 0x7f || noise[2] == 0x7f ||
5113 	    noise[3] == 0x7f)
5114 		goto new;
5115 
5116 	KASSERT(mac->mac_noise.noi_nsamples < 8,
5117 	    ("%s:%d: fail", __func__, __LINE__));
5118 	i = mac->mac_noise.noi_nsamples;
5119 	noise[0] = MIN(MAX(noise[0], 0), N(pg->pg_nrssi_lt) - 1);
5120 	noise[1] = MIN(MAX(noise[1], 0), N(pg->pg_nrssi_lt) - 1);
5121 	noise[2] = MIN(MAX(noise[2], 0), N(pg->pg_nrssi_lt) - 1);
5122 	noise[3] = MIN(MAX(noise[3], 0), N(pg->pg_nrssi_lt) - 1);
5123 	mac->mac_noise.noi_samples[i][0] = pg->pg_nrssi_lt[noise[0]];
5124 	mac->mac_noise.noi_samples[i][1] = pg->pg_nrssi_lt[noise[1]];
5125 	mac->mac_noise.noi_samples[i][2] = pg->pg_nrssi_lt[noise[2]];
5126 	mac->mac_noise.noi_samples[i][3] = pg->pg_nrssi_lt[noise[3]];
5127 	mac->mac_noise.noi_nsamples++;
5128 	if (mac->mac_noise.noi_nsamples == 8) {
5129 		average = 0;
5130 		for (i = 0; i < 8; i++) {
5131 			for (j = 0; j < 4; j++)
5132 				average += mac->mac_noise.noi_samples[i][j];
5133 		}
5134 		average = (((average / 32) * 125) + 64) / 128;
5135 		tmp = (bwn_shm_read_2(mac, BWN_SHARED, 0x40c) / 128) & 0x1f;
5136 		if (tmp >= 8)
5137 			average += 2;
5138 		else
5139 			average -= 25;
5140 		average -= (tmp == 8) ? 72 : 48;
5141 
5142 		mac->mac_stats.link_noise = average;
5143 		mac->mac_noise.noi_running = 0;
5144 		return;
5145 	}
5146 new:
5147 	bwn_noise_gensample(mac);
5148 }
5149 
5150 static int
5151 bwn_pio_rx(struct bwn_pio_rxqueue *prq)
5152 {
5153 	struct bwn_mac *mac = prq->prq_mac;
5154 	struct bwn_softc *sc = mac->mac_sc;
5155 	unsigned int i;
5156 
5157 	BWN_ASSERT_LOCKED(sc);
5158 
5159 	if (mac->mac_status < BWN_MAC_STATUS_STARTED)
5160 		return (0);
5161 
5162 	for (i = 0; i < 5000; i++) {
5163 		if (bwn_pio_rxeof(prq) == 0)
5164 			break;
5165 	}
5166 	if (i >= 5000)
5167 		device_printf(sc->sc_dev, "too many RX frames in PIO mode\n");
5168 	return ((i > 0) ? 1 : 0);
5169 }
5170 
5171 static void
5172 bwn_dma_rx(struct bwn_dma_ring *dr)
5173 {
5174 	int slot, curslot;
5175 
5176 	KASSERT(!dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
5177 	curslot = dr->get_curslot(dr);
5178 	KASSERT(curslot >= 0 && curslot < dr->dr_numslots,
5179 	    ("%s:%d: fail", __func__, __LINE__));
5180 
5181 	slot = dr->dr_curslot;
5182 	for (; slot != curslot; slot = bwn_dma_nextslot(dr, slot))
5183 		bwn_dma_rxeof(dr, &slot);
5184 
5185 	bus_dmamap_sync(dr->dr_ring_dtag, dr->dr_ring_dmap,
5186 	    BUS_DMASYNC_PREWRITE);
5187 
5188 	dr->set_curslot(dr, slot);
5189 	dr->dr_curslot = slot;
5190 }
5191 
5192 static void
5193 bwn_intr_txeof(struct bwn_mac *mac)
5194 {
5195 	struct bwn_txstatus stat;
5196 	uint32_t stat0, stat1;
5197 	uint16_t tmp;
5198 
5199 	BWN_ASSERT_LOCKED(mac->mac_sc);
5200 
5201 	while (1) {
5202 		stat0 = BWN_READ_4(mac, BWN_XMITSTAT_0);
5203 		if (!(stat0 & 0x00000001))
5204 			break;
5205 		stat1 = BWN_READ_4(mac, BWN_XMITSTAT_1);
5206 
5207 		DPRINTF(mac->mac_sc, BWN_DEBUG_XMIT,
5208 		    "%s: stat0=0x%08x, stat1=0x%08x\n",
5209 		    __func__,
5210 		    stat0,
5211 		    stat1);
5212 
5213 		stat.cookie = (stat0 >> 16);
5214 		stat.seq = (stat1 & 0x0000ffff);
5215 		stat.phy_stat = ((stat1 & 0x00ff0000) >> 16);
5216 		tmp = (stat0 & 0x0000ffff);
5217 		stat.framecnt = ((tmp & 0xf000) >> 12);
5218 		stat.rtscnt = ((tmp & 0x0f00) >> 8);
5219 		stat.sreason = ((tmp & 0x001c) >> 2);
5220 		stat.pm = (tmp & 0x0080) ? 1 : 0;
5221 		stat.im = (tmp & 0x0040) ? 1 : 0;
5222 		stat.ampdu = (tmp & 0x0020) ? 1 : 0;
5223 		stat.ack = (tmp & 0x0002) ? 1 : 0;
5224 
5225 		DPRINTF(mac->mac_sc, BWN_DEBUG_XMIT,
5226 		    "%s: cookie=%d, seq=%d, phystat=0x%02x, framecnt=%d, "
5227 		    "rtscnt=%d, sreason=%d, pm=%d, im=%d, ampdu=%d, ack=%d\n",
5228 		    __func__,
5229 		    stat.cookie,
5230 		    stat.seq,
5231 		    stat.phy_stat,
5232 		    stat.framecnt,
5233 		    stat.rtscnt,
5234 		    stat.sreason,
5235 		    stat.pm,
5236 		    stat.im,
5237 		    stat.ampdu,
5238 		    stat.ack);
5239 
5240 		bwn_handle_txeof(mac, &stat);
5241 	}
5242 }
5243 
5244 static void
5245 bwn_hwreset(void *arg, int npending)
5246 {
5247 	struct bwn_mac *mac = arg;
5248 	struct bwn_softc *sc = mac->mac_sc;
5249 	int error = 0;
5250 	int prev_status;
5251 
5252 	BWN_LOCK(sc);
5253 
5254 	prev_status = mac->mac_status;
5255 	if (prev_status >= BWN_MAC_STATUS_STARTED)
5256 		bwn_core_stop(mac);
5257 	if (prev_status >= BWN_MAC_STATUS_INITED)
5258 		bwn_core_exit(mac);
5259 
5260 	if (prev_status >= BWN_MAC_STATUS_INITED) {
5261 		error = bwn_core_init(mac);
5262 		if (error)
5263 			goto out;
5264 	}
5265 	if (prev_status >= BWN_MAC_STATUS_STARTED)
5266 		bwn_core_start(mac);
5267 out:
5268 	if (error) {
5269 		device_printf(sc->sc_dev, "%s: failed (%d)\n", __func__, error);
5270 		sc->sc_curmac = NULL;
5271 	}
5272 	BWN_UNLOCK(sc);
5273 }
5274 
5275 static void
5276 bwn_handle_fwpanic(struct bwn_mac *mac)
5277 {
5278 	struct bwn_softc *sc = mac->mac_sc;
5279 	uint16_t reason;
5280 
5281 	reason = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_FWPANIC_REASON_REG);
5282 	device_printf(sc->sc_dev,"fw panic (%u)\n", reason);
5283 
5284 	if (reason == BWN_FWPANIC_RESTART)
5285 		bwn_restart(mac, "ucode panic");
5286 }
5287 
5288 static void
5289 bwn_load_beacon0(struct bwn_mac *mac)
5290 {
5291 
5292 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5293 }
5294 
5295 static void
5296 bwn_load_beacon1(struct bwn_mac *mac)
5297 {
5298 
5299 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
5300 }
5301 
5302 static uint32_t
5303 bwn_jssi_read(struct bwn_mac *mac)
5304 {
5305 	uint32_t val = 0;
5306 
5307 	val = bwn_shm_read_2(mac, BWN_SHARED, 0x08a);
5308 	val <<= 16;
5309 	val |= bwn_shm_read_2(mac, BWN_SHARED, 0x088);
5310 
5311 	return (val);
5312 }
5313 
5314 static void
5315 bwn_noise_gensample(struct bwn_mac *mac)
5316 {
5317 	uint32_t jssi = 0x7f7f7f7f;
5318 
5319 	bwn_shm_write_2(mac, BWN_SHARED, 0x088, (jssi & 0x0000ffff));
5320 	bwn_shm_write_2(mac, BWN_SHARED, 0x08a, (jssi & 0xffff0000) >> 16);
5321 	BWN_WRITE_4(mac, BWN_MACCMD,
5322 	    BWN_READ_4(mac, BWN_MACCMD) | BWN_MACCMD_BGNOISE);
5323 }
5324 
5325 static int
5326 bwn_dma_freeslot(struct bwn_dma_ring *dr)
5327 {
5328 	BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
5329 
5330 	return (dr->dr_numslots - dr->dr_usedslot);
5331 }
5332 
5333 static int
5334 bwn_dma_nextslot(struct bwn_dma_ring *dr, int slot)
5335 {
5336 	BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
5337 
5338 	KASSERT(slot >= -1 && slot <= dr->dr_numslots - 1,
5339 	    ("%s:%d: fail", __func__, __LINE__));
5340 	if (slot == dr->dr_numslots - 1)
5341 		return (0);
5342 	return (slot + 1);
5343 }
5344 
5345 static void
5346 bwn_dma_rxeof(struct bwn_dma_ring *dr, int *slot)
5347 {
5348 	struct bwn_mac *mac = dr->dr_mac;
5349 	struct bwn_softc *sc = mac->mac_sc;
5350 	struct bwn_dma *dma = &mac->mac_method.dma;
5351 	struct bwn_dmadesc_generic *desc;
5352 	struct bwn_dmadesc_meta *meta;
5353 	struct bwn_rxhdr4 *rxhdr;
5354 	struct mbuf *m;
5355 	uint32_t macstat;
5356 	int32_t tmp;
5357 	int cnt = 0;
5358 	uint16_t len;
5359 
5360 	dr->getdesc(dr, *slot, &desc, &meta);
5361 
5362 	bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap, BUS_DMASYNC_POSTREAD);
5363 	m = meta->mt_m;
5364 
5365 	if (bwn_dma_newbuf(dr, desc, meta, 0)) {
5366 		counter_u64_add(sc->sc_ic.ic_ierrors, 1);
5367 		return;
5368 	}
5369 
5370 	rxhdr = mtod(m, struct bwn_rxhdr4 *);
5371 	len = le16toh(rxhdr->frame_len);
5372 	if (len <= 0) {
5373 		counter_u64_add(sc->sc_ic.ic_ierrors, 1);
5374 		return;
5375 	}
5376 	if (bwn_dma_check_redzone(dr, m)) {
5377 		device_printf(sc->sc_dev, "redzone error.\n");
5378 		bwn_dma_set_redzone(dr, m);
5379 		bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5380 		    BUS_DMASYNC_PREWRITE);
5381 		return;
5382 	}
5383 	if (len > dr->dr_rx_bufsize) {
5384 		tmp = len;
5385 		while (1) {
5386 			dr->getdesc(dr, *slot, &desc, &meta);
5387 			bwn_dma_set_redzone(dr, meta->mt_m);
5388 			bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5389 			    BUS_DMASYNC_PREWRITE);
5390 			*slot = bwn_dma_nextslot(dr, *slot);
5391 			cnt++;
5392 			tmp -= dr->dr_rx_bufsize;
5393 			if (tmp <= 0)
5394 				break;
5395 		}
5396 		device_printf(sc->sc_dev, "too small buffer "
5397 		       "(len %u buffer %u dropped %d)\n",
5398 		       len, dr->dr_rx_bufsize, cnt);
5399 		return;
5400 	}
5401 
5402 	switch (mac->mac_fw.fw_hdr_format) {
5403 	case BWN_FW_HDR_351:
5404 	case BWN_FW_HDR_410:
5405 		macstat = le32toh(rxhdr->ps4.r351.mac_status);
5406 		break;
5407 	case BWN_FW_HDR_598:
5408 		macstat = le32toh(rxhdr->ps4.r598.mac_status);
5409 		break;
5410 	}
5411 
5412 	if (macstat & BWN_RX_MAC_FCSERR) {
5413 		if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADFCS)) {
5414 			device_printf(sc->sc_dev, "RX drop\n");
5415 			return;
5416 		}
5417 	}
5418 
5419 	m->m_len = m->m_pkthdr.len = len + dr->dr_frameoffset;
5420 	m_adj(m, dr->dr_frameoffset);
5421 
5422 	bwn_rxeof(dr->dr_mac, m, rxhdr);
5423 }
5424 
5425 static void
5426 bwn_handle_txeof(struct bwn_mac *mac, const struct bwn_txstatus *status)
5427 {
5428 	struct bwn_softc *sc = mac->mac_sc;
5429 	struct bwn_stats *stats = &mac->mac_stats;
5430 
5431 	BWN_ASSERT_LOCKED(mac->mac_sc);
5432 
5433 	if (status->im)
5434 		device_printf(sc->sc_dev, "TODO: STATUS IM\n");
5435 	if (status->ampdu)
5436 		device_printf(sc->sc_dev, "TODO: STATUS AMPDU\n");
5437 	if (status->rtscnt) {
5438 		if (status->rtscnt == 0xf)
5439 			stats->rtsfail++;
5440 		else
5441 			stats->rts++;
5442 	}
5443 
5444 	if (mac->mac_flags & BWN_MAC_FLAG_DMA) {
5445 		bwn_dma_handle_txeof(mac, status);
5446 	} else {
5447 		bwn_pio_handle_txeof(mac, status);
5448 	}
5449 
5450 	bwn_phy_txpower_check(mac, 0);
5451 }
5452 
5453 static uint8_t
5454 bwn_pio_rxeof(struct bwn_pio_rxqueue *prq)
5455 {
5456 	struct bwn_mac *mac = prq->prq_mac;
5457 	struct bwn_softc *sc = mac->mac_sc;
5458 	struct bwn_rxhdr4 rxhdr;
5459 	struct mbuf *m;
5460 	uint32_t ctl32, macstat, v32;
5461 	unsigned int i, padding;
5462 	uint16_t ctl16, len, totlen, v16;
5463 	unsigned char *mp;
5464 	char *data;
5465 
5466 	memset(&rxhdr, 0, sizeof(rxhdr));
5467 
5468 	if (prq->prq_rev >= 8) {
5469 		ctl32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXCTL);
5470 		if (!(ctl32 & BWN_PIO8_RXCTL_FRAMEREADY))
5471 			return (0);
5472 		bwn_pio_rx_write_4(prq, BWN_PIO8_RXCTL,
5473 		    BWN_PIO8_RXCTL_FRAMEREADY);
5474 		for (i = 0; i < 10; i++) {
5475 			ctl32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXCTL);
5476 			if (ctl32 & BWN_PIO8_RXCTL_DATAREADY)
5477 				goto ready;
5478 			DELAY(10);
5479 		}
5480 	} else {
5481 		ctl16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXCTL);
5482 		if (!(ctl16 & BWN_PIO_RXCTL_FRAMEREADY))
5483 			return (0);
5484 		bwn_pio_rx_write_2(prq, BWN_PIO_RXCTL,
5485 		    BWN_PIO_RXCTL_FRAMEREADY);
5486 		for (i = 0; i < 10; i++) {
5487 			ctl16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXCTL);
5488 			if (ctl16 & BWN_PIO_RXCTL_DATAREADY)
5489 				goto ready;
5490 			DELAY(10);
5491 		}
5492 	}
5493 	device_printf(sc->sc_dev, "%s: timed out\n", __func__);
5494 	return (1);
5495 ready:
5496 	if (prq->prq_rev >= 8)
5497 		siba_read_multi_4(sc->sc_dev, &rxhdr, sizeof(rxhdr),
5498 		    prq->prq_base + BWN_PIO8_RXDATA);
5499 	else
5500 		siba_read_multi_2(sc->sc_dev, &rxhdr, sizeof(rxhdr),
5501 		    prq->prq_base + BWN_PIO_RXDATA);
5502 	len = le16toh(rxhdr.frame_len);
5503 	if (len > 0x700) {
5504 		device_printf(sc->sc_dev, "%s: len is too big\n", __func__);
5505 		goto error;
5506 	}
5507 	if (len == 0) {
5508 		device_printf(sc->sc_dev, "%s: len is 0\n", __func__);
5509 		goto error;
5510 	}
5511 
5512 	switch (mac->mac_fw.fw_hdr_format) {
5513 	case BWN_FW_HDR_351:
5514 	case BWN_FW_HDR_410:
5515 		macstat = le32toh(rxhdr.ps4.r351.mac_status);
5516 		break;
5517 	case BWN_FW_HDR_598:
5518 		macstat = le32toh(rxhdr.ps4.r598.mac_status);
5519 		break;
5520 	}
5521 
5522 	if (macstat & BWN_RX_MAC_FCSERR) {
5523 		if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADFCS)) {
5524 			device_printf(sc->sc_dev, "%s: FCS error", __func__);
5525 			goto error;
5526 		}
5527 	}
5528 
5529 	padding = (macstat & BWN_RX_MAC_PADDING) ? 2 : 0;
5530 	totlen = len + padding;
5531 	KASSERT(totlen <= MCLBYTES, ("too big..\n"));
5532 	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
5533 	if (m == NULL) {
5534 		device_printf(sc->sc_dev, "%s: out of memory", __func__);
5535 		goto error;
5536 	}
5537 	mp = mtod(m, unsigned char *);
5538 	if (prq->prq_rev >= 8) {
5539 		siba_read_multi_4(sc->sc_dev, mp, (totlen & ~3),
5540 		    prq->prq_base + BWN_PIO8_RXDATA);
5541 		if (totlen & 3) {
5542 			v32 = bwn_pio_rx_read_4(prq, BWN_PIO8_RXDATA);
5543 			data = &(mp[totlen - 1]);
5544 			switch (totlen & 3) {
5545 			case 3:
5546 				*data = (v32 >> 16);
5547 				data--;
5548 			case 2:
5549 				*data = (v32 >> 8);
5550 				data--;
5551 			case 1:
5552 				*data = v32;
5553 			}
5554 		}
5555 	} else {
5556 		siba_read_multi_2(sc->sc_dev, mp, (totlen & ~1),
5557 		    prq->prq_base + BWN_PIO_RXDATA);
5558 		if (totlen & 1) {
5559 			v16 = bwn_pio_rx_read_2(prq, BWN_PIO_RXDATA);
5560 			mp[totlen - 1] = v16;
5561 		}
5562 	}
5563 
5564 	m->m_len = m->m_pkthdr.len = totlen;
5565 
5566 	bwn_rxeof(prq->prq_mac, m, &rxhdr);
5567 
5568 	return (1);
5569 error:
5570 	if (prq->prq_rev >= 8)
5571 		bwn_pio_rx_write_4(prq, BWN_PIO8_RXCTL,
5572 		    BWN_PIO8_RXCTL_DATAREADY);
5573 	else
5574 		bwn_pio_rx_write_2(prq, BWN_PIO_RXCTL, BWN_PIO_RXCTL_DATAREADY);
5575 	return (1);
5576 }
5577 
5578 static int
5579 bwn_dma_newbuf(struct bwn_dma_ring *dr, struct bwn_dmadesc_generic *desc,
5580     struct bwn_dmadesc_meta *meta, int init)
5581 {
5582 	struct bwn_mac *mac = dr->dr_mac;
5583 	struct bwn_dma *dma = &mac->mac_method.dma;
5584 	struct bwn_rxhdr4 *hdr;
5585 	bus_dmamap_t map;
5586 	bus_addr_t paddr;
5587 	struct mbuf *m;
5588 	int error;
5589 
5590 	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
5591 	if (m == NULL) {
5592 		error = ENOBUFS;
5593 
5594 		/*
5595 		 * If the NIC is up and running, we need to:
5596 		 * - Clear RX buffer's header.
5597 		 * - Restore RX descriptor settings.
5598 		 */
5599 		if (init)
5600 			return (error);
5601 		else
5602 			goto back;
5603 	}
5604 	m->m_len = m->m_pkthdr.len = MCLBYTES;
5605 
5606 	bwn_dma_set_redzone(dr, m);
5607 
5608 	/*
5609 	 * Try to load RX buf into temporary DMA map
5610 	 */
5611 	error = bus_dmamap_load_mbuf(dma->rxbuf_dtag, dr->dr_spare_dmap, m,
5612 	    bwn_dma_buf_addr, &paddr, BUS_DMA_NOWAIT);
5613 	if (error) {
5614 		m_freem(m);
5615 
5616 		/*
5617 		 * See the comment above
5618 		 */
5619 		if (init)
5620 			return (error);
5621 		else
5622 			goto back;
5623 	}
5624 
5625 	if (!init)
5626 		bus_dmamap_unload(dma->rxbuf_dtag, meta->mt_dmap);
5627 	meta->mt_m = m;
5628 	meta->mt_paddr = paddr;
5629 
5630 	/*
5631 	 * Swap RX buf's DMA map with the loaded temporary one
5632 	 */
5633 	map = meta->mt_dmap;
5634 	meta->mt_dmap = dr->dr_spare_dmap;
5635 	dr->dr_spare_dmap = map;
5636 
5637 back:
5638 	/*
5639 	 * Clear RX buf header
5640 	 */
5641 	hdr = mtod(meta->mt_m, struct bwn_rxhdr4 *);
5642 	bzero(hdr, sizeof(*hdr));
5643 	bus_dmamap_sync(dma->rxbuf_dtag, meta->mt_dmap,
5644 	    BUS_DMASYNC_PREWRITE);
5645 
5646 	/*
5647 	 * Setup RX buf descriptor
5648 	 */
5649 	dr->setdesc(dr, desc, meta->mt_paddr, meta->mt_m->m_len -
5650 	    sizeof(*hdr), 0, 0, 0);
5651 	return (error);
5652 }
5653 
5654 static void
5655 bwn_dma_buf_addr(void *arg, bus_dma_segment_t *seg, int nseg,
5656 		 bus_size_t mapsz __unused, int error)
5657 {
5658 
5659 	if (!error) {
5660 		KASSERT(nseg == 1, ("too many segments(%d)\n", nseg));
5661 		*((bus_addr_t *)arg) = seg->ds_addr;
5662 	}
5663 }
5664 
5665 static int
5666 bwn_hwrate2ieeerate(int rate)
5667 {
5668 
5669 	switch (rate) {
5670 	case BWN_CCK_RATE_1MB:
5671 		return (2);
5672 	case BWN_CCK_RATE_2MB:
5673 		return (4);
5674 	case BWN_CCK_RATE_5MB:
5675 		return (11);
5676 	case BWN_CCK_RATE_11MB:
5677 		return (22);
5678 	case BWN_OFDM_RATE_6MB:
5679 		return (12);
5680 	case BWN_OFDM_RATE_9MB:
5681 		return (18);
5682 	case BWN_OFDM_RATE_12MB:
5683 		return (24);
5684 	case BWN_OFDM_RATE_18MB:
5685 		return (36);
5686 	case BWN_OFDM_RATE_24MB:
5687 		return (48);
5688 	case BWN_OFDM_RATE_36MB:
5689 		return (72);
5690 	case BWN_OFDM_RATE_48MB:
5691 		return (96);
5692 	case BWN_OFDM_RATE_54MB:
5693 		return (108);
5694 	default:
5695 		printf("Ooops\n");
5696 		return (0);
5697 	}
5698 }
5699 
5700 /*
5701  * Post process the RX provided RSSI.
5702  *
5703  * Valid for A, B, G, LP PHYs.
5704  */
5705 static int8_t
5706 bwn_rx_rssi_calc(struct bwn_mac *mac, uint8_t in_rssi,
5707     int ofdm, int adjust_2053, int adjust_2050)
5708 {
5709 	struct bwn_phy *phy = &mac->mac_phy;
5710 	struct bwn_phy_g *gphy = &phy->phy_g;
5711 	int tmp;
5712 
5713 	switch (phy->rf_ver) {
5714 	case 0x2050:
5715 		if (ofdm) {
5716 			tmp = in_rssi;
5717 			if (tmp > 127)
5718 				tmp -= 256;
5719 			tmp = tmp * 73 / 64;
5720 			if (adjust_2050)
5721 				tmp += 25;
5722 			else
5723 				tmp -= 3;
5724 		} else {
5725 			if (siba_sprom_get_bf_lo(mac->mac_sc->sc_dev)
5726 			    & BWN_BFL_RSSI) {
5727 				if (in_rssi > 63)
5728 					in_rssi = 63;
5729 				tmp = gphy->pg_nrssi_lt[in_rssi];
5730 				tmp = (31 - tmp) * -131 / 128 - 57;
5731 			} else {
5732 				tmp = in_rssi;
5733 				tmp = (31 - tmp) * -149 / 128 - 68;
5734 			}
5735 			if (phy->type == BWN_PHYTYPE_G && adjust_2050)
5736 				tmp += 25;
5737 		}
5738 		break;
5739 	case 0x2060:
5740 		if (in_rssi > 127)
5741 			tmp = in_rssi - 256;
5742 		else
5743 			tmp = in_rssi;
5744 		break;
5745 	default:
5746 		tmp = in_rssi;
5747 		tmp = (tmp - 11) * 103 / 64;
5748 		if (adjust_2053)
5749 			tmp -= 109;
5750 		else
5751 			tmp -= 83;
5752 	}
5753 
5754 	return (tmp);
5755 }
5756 
5757 static void
5758 bwn_rxeof(struct bwn_mac *mac, struct mbuf *m, const void *_rxhdr)
5759 {
5760 	const struct bwn_rxhdr4 *rxhdr = _rxhdr;
5761 	struct bwn_plcp6 *plcp;
5762 	struct bwn_softc *sc = mac->mac_sc;
5763 	struct ieee80211_frame_min *wh;
5764 	struct ieee80211_node *ni;
5765 	struct ieee80211com *ic = &sc->sc_ic;
5766 	uint32_t macstat;
5767 	int padding, rate, rssi = 0, noise = 0, type;
5768 	uint16_t phytype, phystat0, phystat3, chanstat;
5769 	unsigned char *mp = mtod(m, unsigned char *);
5770 	static int rx_mac_dec_rpt = 0;
5771 
5772 	BWN_ASSERT_LOCKED(sc);
5773 
5774 	phystat0 = le16toh(rxhdr->phy_status0);
5775 
5776 	/*
5777 	 * XXX Note: phy_status3 doesn't exist for HT-PHY; it's only
5778 	 * used for LP-PHY.
5779 	 */
5780 	phystat3 = le16toh(rxhdr->ps3.lp.phy_status3);
5781 
5782 	switch (mac->mac_fw.fw_hdr_format) {
5783 	case BWN_FW_HDR_351:
5784 	case BWN_FW_HDR_410:
5785 		macstat = le32toh(rxhdr->ps4.r351.mac_status);
5786 		chanstat = le16toh(rxhdr->ps4.r351.channel);
5787 		break;
5788 	case BWN_FW_HDR_598:
5789 		macstat = le32toh(rxhdr->ps4.r598.mac_status);
5790 		chanstat = le16toh(rxhdr->ps4.r598.channel);
5791 		break;
5792 	}
5793 
5794 
5795 	phytype = chanstat & BWN_RX_CHAN_PHYTYPE;
5796 
5797 	if (macstat & BWN_RX_MAC_FCSERR)
5798 		device_printf(sc->sc_dev, "TODO RX: RX_FLAG_FAILED_FCS_CRC\n");
5799 	if (phystat0 & (BWN_RX_PHYST0_PLCPHCF | BWN_RX_PHYST0_PLCPFV))
5800 		device_printf(sc->sc_dev, "TODO RX: RX_FLAG_FAILED_PLCP_CRC\n");
5801 	if (macstat & BWN_RX_MAC_DECERR)
5802 		goto drop;
5803 
5804 	padding = (macstat & BWN_RX_MAC_PADDING) ? 2 : 0;
5805 	if (m->m_pkthdr.len < (sizeof(struct bwn_plcp6) + padding)) {
5806 		device_printf(sc->sc_dev, "frame too short (length=%d)\n",
5807 		    m->m_pkthdr.len);
5808 		goto drop;
5809 	}
5810 	plcp = (struct bwn_plcp6 *)(mp + padding);
5811 	m_adj(m, sizeof(struct bwn_plcp6) + padding);
5812 	if (m->m_pkthdr.len < IEEE80211_MIN_LEN) {
5813 		device_printf(sc->sc_dev, "frame too short (length=%d)\n",
5814 		    m->m_pkthdr.len);
5815 		goto drop;
5816 	}
5817 	wh = mtod(m, struct ieee80211_frame_min *);
5818 
5819 	if (macstat & BWN_RX_MAC_DEC && rx_mac_dec_rpt++ < 50)
5820 		device_printf(sc->sc_dev,
5821 		    "RX decryption attempted (old %d keyidx %#x)\n",
5822 		    BWN_ISOLDFMT(mac),
5823 		    (macstat & BWN_RX_MAC_KEYIDX) >> BWN_RX_MAC_KEYIDX_SHIFT);
5824 
5825 	if (phystat0 & BWN_RX_PHYST0_OFDM)
5826 		rate = bwn_plcp_get_ofdmrate(mac, plcp,
5827 		    phytype == BWN_PHYTYPE_A);
5828 	else
5829 		rate = bwn_plcp_get_cckrate(mac, plcp);
5830 	if (rate == -1) {
5831 		if (!(mac->mac_sc->sc_filters & BWN_MACCTL_PASS_BADPLCP))
5832 			goto drop;
5833 	}
5834 	sc->sc_rx_rate = bwn_hwrate2ieeerate(rate);
5835 
5836 	/* rssi/noise */
5837 	switch (phytype) {
5838 	case BWN_PHYTYPE_A:
5839 	case BWN_PHYTYPE_B:
5840 	case BWN_PHYTYPE_G:
5841 	case BWN_PHYTYPE_LP:
5842 		rssi = bwn_rx_rssi_calc(mac, rxhdr->phy.abg.rssi,
5843 		    !! (phystat0 & BWN_RX_PHYST0_OFDM),
5844 		    !! (phystat0 & BWN_RX_PHYST0_GAINCTL),
5845 		    !! (phystat3 & BWN_RX_PHYST3_TRSTATE));
5846 		break;
5847 	case BWN_PHYTYPE_N:
5848 		/* Broadcom has code for min/avg, but always used max */
5849 		if (rxhdr->phy.n.power0 == 16 || rxhdr->phy.n.power0 == 32)
5850 			rssi = max(rxhdr->phy.n.power1, rxhdr->ps2.n.power2);
5851 		else
5852 			rssi = max(rxhdr->phy.n.power0, rxhdr->phy.n.power1);
5853 #if 0
5854 		DPRINTF(mac->mac_sc, BWN_DEBUG_RECV,
5855 		    "%s: power0=%d, power1=%d, power2=%d\n",
5856 		    __func__,
5857 		    rxhdr->phy.n.power0,
5858 		    rxhdr->phy.n.power1,
5859 		    rxhdr->ps2.n.power2);
5860 #endif
5861 		break;
5862 	default:
5863 		/* XXX TODO: implement rssi for other PHYs */
5864 		break;
5865 	}
5866 
5867 	/*
5868 	 * RSSI here is absolute, not relative to the noise floor.
5869 	 */
5870 	noise = mac->mac_stats.link_noise;
5871 	rssi = rssi - noise;
5872 
5873 	/* RX radio tap */
5874 	if (ieee80211_radiotap_active(ic))
5875 		bwn_rx_radiotap(mac, m, rxhdr, plcp, rate, rssi, noise);
5876 	m_adj(m, -IEEE80211_CRC_LEN);
5877 
5878 	BWN_UNLOCK(sc);
5879 
5880 	ni = ieee80211_find_rxnode(ic, wh);
5881 	if (ni != NULL) {
5882 		type = ieee80211_input(ni, m, rssi, noise);
5883 		ieee80211_free_node(ni);
5884 	} else
5885 		type = ieee80211_input_all(ic, m, rssi, noise);
5886 
5887 	BWN_LOCK(sc);
5888 	return;
5889 drop:
5890 	device_printf(sc->sc_dev, "%s: dropped\n", __func__);
5891 }
5892 
5893 static void
5894 bwn_dma_handle_txeof(struct bwn_mac *mac,
5895     const struct bwn_txstatus *status)
5896 {
5897 	struct bwn_dma *dma = &mac->mac_method.dma;
5898 	struct bwn_dma_ring *dr;
5899 	struct bwn_dmadesc_generic *desc;
5900 	struct bwn_dmadesc_meta *meta;
5901 	struct bwn_softc *sc = mac->mac_sc;
5902 	int slot;
5903 	int retrycnt = 0;
5904 
5905 	BWN_ASSERT_LOCKED(sc);
5906 
5907 	dr = bwn_dma_parse_cookie(mac, status, status->cookie, &slot);
5908 	if (dr == NULL) {
5909 		device_printf(sc->sc_dev, "failed to parse cookie\n");
5910 		return;
5911 	}
5912 	KASSERT(dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
5913 
5914 	while (1) {
5915 		KASSERT(slot >= 0 && slot < dr->dr_numslots,
5916 		    ("%s:%d: fail", __func__, __LINE__));
5917 		dr->getdesc(dr, slot, &desc, &meta);
5918 
5919 		if (meta->mt_txtype == BWN_DMADESC_METATYPE_HEADER)
5920 			bus_dmamap_unload(dr->dr_txring_dtag, meta->mt_dmap);
5921 		else if (meta->mt_txtype == BWN_DMADESC_METATYPE_BODY)
5922 			bus_dmamap_unload(dma->txbuf_dtag, meta->mt_dmap);
5923 
5924 		if (meta->mt_islast) {
5925 			KASSERT(meta->mt_m != NULL,
5926 			    ("%s:%d: fail", __func__, __LINE__));
5927 
5928 			/*
5929 			 * If we don't get an ACK, then we should log the
5930 			 * full framecnt.  That may be 0 if it's a PHY
5931 			 * failure, so ensure that gets logged as some
5932 			 * retry attempt.
5933 			 */
5934 			if (status->ack) {
5935 				retrycnt = status->framecnt - 1;
5936 			} else {
5937 				retrycnt = status->framecnt;
5938 				if (retrycnt == 0)
5939 					retrycnt = 1;
5940 			}
5941 			ieee80211_ratectl_tx_complete(meta->mt_ni->ni_vap, meta->mt_ni,
5942 			    status->ack ?
5943 			      IEEE80211_RATECTL_TX_SUCCESS :
5944 			      IEEE80211_RATECTL_TX_FAILURE,
5945 			    &retrycnt, 0);
5946 			ieee80211_tx_complete(meta->mt_ni, meta->mt_m, 0);
5947 			meta->mt_ni = NULL;
5948 			meta->mt_m = NULL;
5949 		} else
5950 			KASSERT(meta->mt_m == NULL,
5951 			    ("%s:%d: fail", __func__, __LINE__));
5952 
5953 		dr->dr_usedslot--;
5954 		if (meta->mt_islast)
5955 			break;
5956 		slot = bwn_dma_nextslot(dr, slot);
5957 	}
5958 	sc->sc_watchdog_timer = 0;
5959 	if (dr->dr_stop) {
5960 		KASSERT(bwn_dma_freeslot(dr) >= BWN_TX_SLOTS_PER_FRAME,
5961 		    ("%s:%d: fail", __func__, __LINE__));
5962 		dr->dr_stop = 0;
5963 	}
5964 }
5965 
5966 static void
5967 bwn_pio_handle_txeof(struct bwn_mac *mac,
5968     const struct bwn_txstatus *status)
5969 {
5970 	struct bwn_pio_txqueue *tq;
5971 	struct bwn_pio_txpkt *tp = NULL;
5972 	struct bwn_softc *sc = mac->mac_sc;
5973 	int retrycnt = 0;
5974 
5975 	BWN_ASSERT_LOCKED(sc);
5976 
5977 	tq = bwn_pio_parse_cookie(mac, status->cookie, &tp);
5978 	if (tq == NULL)
5979 		return;
5980 
5981 	tq->tq_used -= roundup(tp->tp_m->m_pkthdr.len + BWN_HDRSIZE(mac), 4);
5982 	tq->tq_free++;
5983 
5984 	if (tp->tp_ni != NULL) {
5985 		/*
5986 		 * Do any tx complete callback.  Note this must
5987 		 * be done before releasing the node reference.
5988 		 */
5989 
5990 		/*
5991 		 * If we don't get an ACK, then we should log the
5992 		 * full framecnt.  That may be 0 if it's a PHY
5993 		 * failure, so ensure that gets logged as some
5994 		 * retry attempt.
5995 		 */
5996 		if (status->ack) {
5997 			retrycnt = status->framecnt - 1;
5998 		} else {
5999 			retrycnt = status->framecnt;
6000 			if (retrycnt == 0)
6001 				retrycnt = 1;
6002 		}
6003 		ieee80211_ratectl_tx_complete(tp->tp_ni->ni_vap, tp->tp_ni,
6004 		    status->ack ?
6005 		      IEEE80211_RATECTL_TX_SUCCESS :
6006 		      IEEE80211_RATECTL_TX_FAILURE,
6007 		    &retrycnt, 0);
6008 
6009 		if (tp->tp_m->m_flags & M_TXCB)
6010 			ieee80211_process_callback(tp->tp_ni, tp->tp_m, 0);
6011 		ieee80211_free_node(tp->tp_ni);
6012 		tp->tp_ni = NULL;
6013 	}
6014 	m_freem(tp->tp_m);
6015 	tp->tp_m = NULL;
6016 	TAILQ_INSERT_TAIL(&tq->tq_pktlist, tp, tp_list);
6017 
6018 	sc->sc_watchdog_timer = 0;
6019 }
6020 
6021 static void
6022 bwn_phy_txpower_check(struct bwn_mac *mac, uint32_t flags)
6023 {
6024 	struct bwn_softc *sc = mac->mac_sc;
6025 	struct bwn_phy *phy = &mac->mac_phy;
6026 	struct ieee80211com *ic = &sc->sc_ic;
6027 	unsigned long now;
6028 	bwn_txpwr_result_t result;
6029 
6030 	BWN_GETTIME(now);
6031 
6032 	if (!(flags & BWN_TXPWR_IGNORE_TIME) && ieee80211_time_before(now, phy->nexttime))
6033 		return;
6034 	phy->nexttime = now + 2 * 1000;
6035 
6036 	if (siba_get_pci_subvendor(sc->sc_dev) == SIBA_BOARDVENDOR_BCM &&
6037 	    siba_get_pci_subdevice(sc->sc_dev) == SIBA_BOARD_BU4306)
6038 		return;
6039 
6040 	if (phy->recalc_txpwr != NULL) {
6041 		result = phy->recalc_txpwr(mac,
6042 		    (flags & BWN_TXPWR_IGNORE_TSSI) ? 1 : 0);
6043 		if (result == BWN_TXPWR_RES_DONE)
6044 			return;
6045 		KASSERT(result == BWN_TXPWR_RES_NEED_ADJUST,
6046 		    ("%s: fail", __func__));
6047 		KASSERT(phy->set_txpwr != NULL, ("%s: fail", __func__));
6048 
6049 		ieee80211_runtask(ic, &mac->mac_txpower);
6050 	}
6051 }
6052 
6053 static uint16_t
6054 bwn_pio_rx_read_2(struct bwn_pio_rxqueue *prq, uint16_t offset)
6055 {
6056 
6057 	return (BWN_READ_2(prq->prq_mac, prq->prq_base + offset));
6058 }
6059 
6060 static uint32_t
6061 bwn_pio_rx_read_4(struct bwn_pio_rxqueue *prq, uint16_t offset)
6062 {
6063 
6064 	return (BWN_READ_4(prq->prq_mac, prq->prq_base + offset));
6065 }
6066 
6067 static void
6068 bwn_pio_rx_write_2(struct bwn_pio_rxqueue *prq, uint16_t offset, uint16_t value)
6069 {
6070 
6071 	BWN_WRITE_2(prq->prq_mac, prq->prq_base + offset, value);
6072 }
6073 
6074 static void
6075 bwn_pio_rx_write_4(struct bwn_pio_rxqueue *prq, uint16_t offset, uint32_t value)
6076 {
6077 
6078 	BWN_WRITE_4(prq->prq_mac, prq->prq_base + offset, value);
6079 }
6080 
6081 static int
6082 bwn_ieeerate2hwrate(struct bwn_softc *sc, int rate)
6083 {
6084 
6085 	switch (rate) {
6086 	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
6087 	case 12:
6088 		return (BWN_OFDM_RATE_6MB);
6089 	case 18:
6090 		return (BWN_OFDM_RATE_9MB);
6091 	case 24:
6092 		return (BWN_OFDM_RATE_12MB);
6093 	case 36:
6094 		return (BWN_OFDM_RATE_18MB);
6095 	case 48:
6096 		return (BWN_OFDM_RATE_24MB);
6097 	case 72:
6098 		return (BWN_OFDM_RATE_36MB);
6099 	case 96:
6100 		return (BWN_OFDM_RATE_48MB);
6101 	case 108:
6102 		return (BWN_OFDM_RATE_54MB);
6103 	/* CCK rates (NB: not IEEE std, device-specific) */
6104 	case 2:
6105 		return (BWN_CCK_RATE_1MB);
6106 	case 4:
6107 		return (BWN_CCK_RATE_2MB);
6108 	case 11:
6109 		return (BWN_CCK_RATE_5MB);
6110 	case 22:
6111 		return (BWN_CCK_RATE_11MB);
6112 	}
6113 
6114 	device_printf(sc->sc_dev, "unsupported rate %d\n", rate);
6115 	return (BWN_CCK_RATE_1MB);
6116 }
6117 
6118 static uint16_t
6119 bwn_set_txhdr_phyctl1(struct bwn_mac *mac, uint8_t bitrate)
6120 {
6121 	struct bwn_phy *phy = &mac->mac_phy;
6122 	uint16_t control = 0;
6123 	uint16_t bw;
6124 
6125 	/* XXX TODO: this is for LP phy, what about N-PHY, etc? */
6126 	bw = BWN_TXH_PHY1_BW_20;
6127 
6128 	if (BWN_ISCCKRATE(bitrate) && phy->type != BWN_PHYTYPE_LP) {
6129 		control = bw;
6130 	} else {
6131 		control = bw;
6132 		/* Figure out coding rate and modulation */
6133 		/* XXX TODO: table-ize, for MCS transmit */
6134 		/* Note: this is BWN_*_RATE values */
6135 		switch (bitrate) {
6136 		case BWN_CCK_RATE_1MB:
6137 			control |= 0;
6138 			break;
6139 		case BWN_CCK_RATE_2MB:
6140 			control |= 1;
6141 			break;
6142 		case BWN_CCK_RATE_5MB:
6143 			control |= 2;
6144 			break;
6145 		case BWN_CCK_RATE_11MB:
6146 			control |= 3;
6147 			break;
6148 		case BWN_OFDM_RATE_6MB:
6149 			control |= BWN_TXH_PHY1_CRATE_1_2;
6150 			control |= BWN_TXH_PHY1_MODUL_BPSK;
6151 			break;
6152 		case BWN_OFDM_RATE_9MB:
6153 			control |= BWN_TXH_PHY1_CRATE_3_4;
6154 			control |= BWN_TXH_PHY1_MODUL_BPSK;
6155 			break;
6156 		case BWN_OFDM_RATE_12MB:
6157 			control |= BWN_TXH_PHY1_CRATE_1_2;
6158 			control |= BWN_TXH_PHY1_MODUL_QPSK;
6159 			break;
6160 		case BWN_OFDM_RATE_18MB:
6161 			control |= BWN_TXH_PHY1_CRATE_3_4;
6162 			control |= BWN_TXH_PHY1_MODUL_QPSK;
6163 			break;
6164 		case BWN_OFDM_RATE_24MB:
6165 			control |= BWN_TXH_PHY1_CRATE_1_2;
6166 			control |= BWN_TXH_PHY1_MODUL_QAM16;
6167 			break;
6168 		case BWN_OFDM_RATE_36MB:
6169 			control |= BWN_TXH_PHY1_CRATE_3_4;
6170 			control |= BWN_TXH_PHY1_MODUL_QAM16;
6171 			break;
6172 		case BWN_OFDM_RATE_48MB:
6173 			control |= BWN_TXH_PHY1_CRATE_1_2;
6174 			control |= BWN_TXH_PHY1_MODUL_QAM64;
6175 			break;
6176 		case BWN_OFDM_RATE_54MB:
6177 			control |= BWN_TXH_PHY1_CRATE_3_4;
6178 			control |= BWN_TXH_PHY1_MODUL_QAM64;
6179 			break;
6180 		default:
6181 			break;
6182 		}
6183 		control |= BWN_TXH_PHY1_MODE_SISO;
6184 	}
6185 
6186 	return control;
6187 }
6188 
6189 static int
6190 bwn_set_txhdr(struct bwn_mac *mac, struct ieee80211_node *ni,
6191     struct mbuf *m, struct bwn_txhdr *txhdr, uint16_t cookie)
6192 {
6193 	const struct bwn_phy *phy = &mac->mac_phy;
6194 	struct bwn_softc *sc = mac->mac_sc;
6195 	struct ieee80211_frame *wh;
6196 	struct ieee80211_frame *protwh;
6197 	struct ieee80211_frame_cts *cts;
6198 	struct ieee80211_frame_rts *rts;
6199 	const struct ieee80211_txparam *tp;
6200 	struct ieee80211vap *vap = ni->ni_vap;
6201 	struct ieee80211com *ic = &sc->sc_ic;
6202 	struct mbuf *mprot;
6203 	unsigned int len;
6204 	uint32_t macctl = 0;
6205 	int protdur, rts_rate, rts_rate_fb, ismcast, isshort, rix, type;
6206 	uint16_t phyctl = 0;
6207 	uint8_t rate, rate_fb;
6208 	int fill_phy_ctl1 = 0;
6209 
6210 	wh = mtod(m, struct ieee80211_frame *);
6211 	memset(txhdr, 0, sizeof(*txhdr));
6212 
6213 	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
6214 	ismcast = IEEE80211_IS_MULTICAST(wh->i_addr1);
6215 	isshort = (ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0;
6216 
6217 	if ((phy->type == BWN_PHYTYPE_N) || (phy->type == BWN_PHYTYPE_LP)
6218 	    || (phy->type == BWN_PHYTYPE_HT))
6219 		fill_phy_ctl1 = 1;
6220 
6221 	/*
6222 	 * Find TX rate
6223 	 */
6224 	tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)];
6225 	if (type != IEEE80211_FC0_TYPE_DATA || (m->m_flags & M_EAPOL))
6226 		rate = rate_fb = tp->mgmtrate;
6227 	else if (ismcast)
6228 		rate = rate_fb = tp->mcastrate;
6229 	else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
6230 		rate = rate_fb = tp->ucastrate;
6231 	else {
6232 		rix = ieee80211_ratectl_rate(ni, NULL, 0);
6233 		rate = ni->ni_txrate;
6234 
6235 		if (rix > 0)
6236 			rate_fb = ni->ni_rates.rs_rates[rix - 1] &
6237 			    IEEE80211_RATE_VAL;
6238 		else
6239 			rate_fb = rate;
6240 	}
6241 
6242 	sc->sc_tx_rate = rate;
6243 
6244 	/* Note: this maps the select ieee80211 rate to hardware rate */
6245 	rate = bwn_ieeerate2hwrate(sc, rate);
6246 	rate_fb = bwn_ieeerate2hwrate(sc, rate_fb);
6247 
6248 	txhdr->phyrate = (BWN_ISOFDMRATE(rate)) ? bwn_plcp_getofdm(rate) :
6249 	    bwn_plcp_getcck(rate);
6250 	bcopy(wh->i_fc, txhdr->macfc, sizeof(txhdr->macfc));
6251 	bcopy(wh->i_addr1, txhdr->addr1, IEEE80211_ADDR_LEN);
6252 
6253 	/* XXX rate/rate_fb is the hardware rate */
6254 	if ((rate_fb == rate) ||
6255 	    (*(u_int16_t *)wh->i_dur & htole16(0x8000)) ||
6256 	    (*(u_int16_t *)wh->i_dur == htole16(0)))
6257 		txhdr->dur_fb = *(u_int16_t *)wh->i_dur;
6258 	else
6259 		txhdr->dur_fb = ieee80211_compute_duration(ic->ic_rt,
6260 		    m->m_pkthdr.len, rate, isshort);
6261 
6262 	/* XXX TX encryption */
6263 
6264 	switch (mac->mac_fw.fw_hdr_format) {
6265 	case BWN_FW_HDR_351:
6266 		bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r351.plcp),
6267 		    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
6268 		break;
6269 	case BWN_FW_HDR_410:
6270 		bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r410.plcp),
6271 		    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
6272 		break;
6273 	case BWN_FW_HDR_598:
6274 		bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->body.r598.plcp),
6275 		    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate);
6276 		break;
6277 	}
6278 
6279 	bwn_plcp_genhdr((struct bwn_plcp4 *)(&txhdr->plcp_fb),
6280 	    m->m_pkthdr.len + IEEE80211_CRC_LEN, rate_fb);
6281 
6282 	txhdr->eftypes |= (BWN_ISOFDMRATE(rate_fb)) ? BWN_TX_EFT_FB_OFDM :
6283 	    BWN_TX_EFT_FB_CCK;
6284 	txhdr->chan = phy->chan;
6285 	phyctl |= (BWN_ISOFDMRATE(rate)) ? BWN_TX_PHY_ENC_OFDM :
6286 	    BWN_TX_PHY_ENC_CCK;
6287 	/* XXX preamble? obey net80211 */
6288 	if (isshort && (rate == BWN_CCK_RATE_2MB || rate == BWN_CCK_RATE_5MB ||
6289 	     rate == BWN_CCK_RATE_11MB))
6290 		phyctl |= BWN_TX_PHY_SHORTPRMBL;
6291 
6292 	if (! phy->gmode)
6293 		macctl |= BWN_TX_MAC_5GHZ;
6294 
6295 	/* XXX TX antenna selection */
6296 
6297 	switch (bwn_antenna_sanitize(mac, 0)) {
6298 	case 0:
6299 		phyctl |= BWN_TX_PHY_ANT01AUTO;
6300 		break;
6301 	case 1:
6302 		phyctl |= BWN_TX_PHY_ANT0;
6303 		break;
6304 	case 2:
6305 		phyctl |= BWN_TX_PHY_ANT1;
6306 		break;
6307 	case 3:
6308 		phyctl |= BWN_TX_PHY_ANT2;
6309 		break;
6310 	case 4:
6311 		phyctl |= BWN_TX_PHY_ANT3;
6312 		break;
6313 	default:
6314 		KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6315 	}
6316 
6317 	if (!ismcast)
6318 		macctl |= BWN_TX_MAC_ACK;
6319 
6320 	macctl |= (BWN_TX_MAC_HWSEQ | BWN_TX_MAC_START_MSDU);
6321 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
6322 	    m->m_pkthdr.len + IEEE80211_CRC_LEN > vap->iv_rtsthreshold)
6323 		macctl |= BWN_TX_MAC_LONGFRAME;
6324 
6325 	if (ic->ic_flags & IEEE80211_F_USEPROT) {
6326 		/* Note: don't fall back to CCK rates for 5G */
6327 		if (phy->gmode)
6328 			rts_rate = BWN_CCK_RATE_1MB;
6329 		else
6330 			rts_rate = BWN_OFDM_RATE_6MB;
6331 		rts_rate_fb = bwn_get_fbrate(rts_rate);
6332 
6333 		/* XXX 'rate' here is hardware rate now, not the net80211 rate */
6334 		protdur = ieee80211_compute_duration(ic->ic_rt,
6335 		    m->m_pkthdr.len, rate, isshort) +
6336 		    + ieee80211_ack_duration(ic->ic_rt, rate, isshort);
6337 
6338 		if (ic->ic_protmode == IEEE80211_PROT_CTSONLY) {
6339 
6340 			switch (mac->mac_fw.fw_hdr_format) {
6341 			case BWN_FW_HDR_351:
6342 				cts = (struct ieee80211_frame_cts *)
6343 				    txhdr->body.r351.rts_frame;
6344 				break;
6345 			case BWN_FW_HDR_410:
6346 				cts = (struct ieee80211_frame_cts *)
6347 				    txhdr->body.r410.rts_frame;
6348 				break;
6349 			case BWN_FW_HDR_598:
6350 				cts = (struct ieee80211_frame_cts *)
6351 				    txhdr->body.r598.rts_frame;
6352 				break;
6353 			}
6354 
6355 			mprot = ieee80211_alloc_cts(ic, ni->ni_vap->iv_myaddr,
6356 			    protdur);
6357 			KASSERT(mprot != NULL, ("failed to alloc mbuf\n"));
6358 			bcopy(mtod(mprot, uint8_t *), (uint8_t *)cts,
6359 			    mprot->m_pkthdr.len);
6360 			m_freem(mprot);
6361 			macctl |= BWN_TX_MAC_SEND_CTSTOSELF;
6362 			len = sizeof(struct ieee80211_frame_cts);
6363 		} else {
6364 			switch (mac->mac_fw.fw_hdr_format) {
6365 			case BWN_FW_HDR_351:
6366 				rts = (struct ieee80211_frame_rts *)
6367 				    txhdr->body.r351.rts_frame;
6368 				break;
6369 			case BWN_FW_HDR_410:
6370 				rts = (struct ieee80211_frame_rts *)
6371 				    txhdr->body.r410.rts_frame;
6372 				break;
6373 			case BWN_FW_HDR_598:
6374 				rts = (struct ieee80211_frame_rts *)
6375 				    txhdr->body.r598.rts_frame;
6376 				break;
6377 			}
6378 
6379 			/* XXX rate/rate_fb is the hardware rate */
6380 			protdur += ieee80211_ack_duration(ic->ic_rt, rate,
6381 			    isshort);
6382 			mprot = ieee80211_alloc_rts(ic, wh->i_addr1,
6383 			    wh->i_addr2, protdur);
6384 			KASSERT(mprot != NULL, ("failed to alloc mbuf\n"));
6385 			bcopy(mtod(mprot, uint8_t *), (uint8_t *)rts,
6386 			    mprot->m_pkthdr.len);
6387 			m_freem(mprot);
6388 			macctl |= BWN_TX_MAC_SEND_RTSCTS;
6389 			len = sizeof(struct ieee80211_frame_rts);
6390 		}
6391 		len += IEEE80211_CRC_LEN;
6392 
6393 		switch (mac->mac_fw.fw_hdr_format) {
6394 		case BWN_FW_HDR_351:
6395 			bwn_plcp_genhdr((struct bwn_plcp4 *)
6396 			    &txhdr->body.r351.rts_plcp, len, rts_rate);
6397 			break;
6398 		case BWN_FW_HDR_410:
6399 			bwn_plcp_genhdr((struct bwn_plcp4 *)
6400 			    &txhdr->body.r410.rts_plcp, len, rts_rate);
6401 			break;
6402 		case BWN_FW_HDR_598:
6403 			bwn_plcp_genhdr((struct bwn_plcp4 *)
6404 			    &txhdr->body.r598.rts_plcp, len, rts_rate);
6405 			break;
6406 		}
6407 
6408 		bwn_plcp_genhdr((struct bwn_plcp4 *)&txhdr->rts_plcp_fb, len,
6409 		    rts_rate_fb);
6410 
6411 		switch (mac->mac_fw.fw_hdr_format) {
6412 		case BWN_FW_HDR_351:
6413 			protwh = (struct ieee80211_frame *)
6414 			    &txhdr->body.r351.rts_frame;
6415 			break;
6416 		case BWN_FW_HDR_410:
6417 			protwh = (struct ieee80211_frame *)
6418 			    &txhdr->body.r410.rts_frame;
6419 			break;
6420 		case BWN_FW_HDR_598:
6421 			protwh = (struct ieee80211_frame *)
6422 			    &txhdr->body.r598.rts_frame;
6423 			break;
6424 		}
6425 
6426 		txhdr->rts_dur_fb = *(u_int16_t *)protwh->i_dur;
6427 
6428 		if (BWN_ISOFDMRATE(rts_rate)) {
6429 			txhdr->eftypes |= BWN_TX_EFT_RTS_OFDM;
6430 			txhdr->phyrate_rts = bwn_plcp_getofdm(rts_rate);
6431 		} else {
6432 			txhdr->eftypes |= BWN_TX_EFT_RTS_CCK;
6433 			txhdr->phyrate_rts = bwn_plcp_getcck(rts_rate);
6434 		}
6435 		txhdr->eftypes |= (BWN_ISOFDMRATE(rts_rate_fb)) ?
6436 		    BWN_TX_EFT_RTS_FBOFDM : BWN_TX_EFT_RTS_FBCCK;
6437 
6438 		if (fill_phy_ctl1) {
6439 			txhdr->phyctl_1rts = htole16(bwn_set_txhdr_phyctl1(mac, rts_rate));
6440 			txhdr->phyctl_1rtsfb = htole16(bwn_set_txhdr_phyctl1(mac, rts_rate_fb));
6441 		}
6442 	}
6443 
6444 	if (fill_phy_ctl1) {
6445 		txhdr->phyctl_1 = htole16(bwn_set_txhdr_phyctl1(mac, rate));
6446 		txhdr->phyctl_1fb = htole16(bwn_set_txhdr_phyctl1(mac, rate_fb));
6447 	}
6448 
6449 	switch (mac->mac_fw.fw_hdr_format) {
6450 	case BWN_FW_HDR_351:
6451 		txhdr->body.r351.cookie = htole16(cookie);
6452 		break;
6453 	case BWN_FW_HDR_410:
6454 		txhdr->body.r410.cookie = htole16(cookie);
6455 		break;
6456 	case BWN_FW_HDR_598:
6457 		txhdr->body.r598.cookie = htole16(cookie);
6458 		break;
6459 	}
6460 
6461 	txhdr->macctl = htole32(macctl);
6462 	txhdr->phyctl = htole16(phyctl);
6463 
6464 	/*
6465 	 * TX radio tap
6466 	 */
6467 	if (ieee80211_radiotap_active_vap(vap)) {
6468 		sc->sc_tx_th.wt_flags = 0;
6469 		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
6470 			sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_WEP;
6471 		if (isshort &&
6472 		    (rate == BWN_CCK_RATE_2MB || rate == BWN_CCK_RATE_5MB ||
6473 		     rate == BWN_CCK_RATE_11MB))
6474 			sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
6475 		sc->sc_tx_th.wt_rate = rate;
6476 
6477 		ieee80211_radiotap_tx(vap, m);
6478 	}
6479 
6480 	return (0);
6481 }
6482 
6483 static void
6484 bwn_plcp_genhdr(struct bwn_plcp4 *plcp, const uint16_t octets,
6485     const uint8_t rate)
6486 {
6487 	uint32_t d, plen;
6488 	uint8_t *raw = plcp->o.raw;
6489 
6490 	if (BWN_ISOFDMRATE(rate)) {
6491 		d = bwn_plcp_getofdm(rate);
6492 		KASSERT(!(octets & 0xf000),
6493 		    ("%s:%d: fail", __func__, __LINE__));
6494 		d |= (octets << 5);
6495 		plcp->o.data = htole32(d);
6496 	} else {
6497 		plen = octets * 16 / rate;
6498 		if ((octets * 16 % rate) > 0) {
6499 			plen++;
6500 			if ((rate == BWN_CCK_RATE_11MB)
6501 			    && ((octets * 8 % 11) < 4)) {
6502 				raw[1] = 0x84;
6503 			} else
6504 				raw[1] = 0x04;
6505 		} else
6506 			raw[1] = 0x04;
6507 		plcp->o.data |= htole32(plen << 16);
6508 		raw[0] = bwn_plcp_getcck(rate);
6509 	}
6510 }
6511 
6512 static uint8_t
6513 bwn_antenna_sanitize(struct bwn_mac *mac, uint8_t n)
6514 {
6515 	struct bwn_softc *sc = mac->mac_sc;
6516 	uint8_t mask;
6517 
6518 	if (n == 0)
6519 		return (0);
6520 	if (mac->mac_phy.gmode)
6521 		mask = siba_sprom_get_ant_bg(sc->sc_dev);
6522 	else
6523 		mask = siba_sprom_get_ant_a(sc->sc_dev);
6524 	if (!(mask & (1 << (n - 1))))
6525 		return (0);
6526 	return (n);
6527 }
6528 
6529 /*
6530  * Return a fallback rate for the given rate.
6531  *
6532  * Note: Don't fall back from OFDM to CCK.
6533  */
6534 static uint8_t
6535 bwn_get_fbrate(uint8_t bitrate)
6536 {
6537 	switch (bitrate) {
6538 	/* CCK */
6539 	case BWN_CCK_RATE_1MB:
6540 		return (BWN_CCK_RATE_1MB);
6541 	case BWN_CCK_RATE_2MB:
6542 		return (BWN_CCK_RATE_1MB);
6543 	case BWN_CCK_RATE_5MB:
6544 		return (BWN_CCK_RATE_2MB);
6545 	case BWN_CCK_RATE_11MB:
6546 		return (BWN_CCK_RATE_5MB);
6547 
6548 	/* OFDM */
6549 	case BWN_OFDM_RATE_6MB:
6550 		return (BWN_OFDM_RATE_6MB);
6551 	case BWN_OFDM_RATE_9MB:
6552 		return (BWN_OFDM_RATE_6MB);
6553 	case BWN_OFDM_RATE_12MB:
6554 		return (BWN_OFDM_RATE_9MB);
6555 	case BWN_OFDM_RATE_18MB:
6556 		return (BWN_OFDM_RATE_12MB);
6557 	case BWN_OFDM_RATE_24MB:
6558 		return (BWN_OFDM_RATE_18MB);
6559 	case BWN_OFDM_RATE_36MB:
6560 		return (BWN_OFDM_RATE_24MB);
6561 	case BWN_OFDM_RATE_48MB:
6562 		return (BWN_OFDM_RATE_36MB);
6563 	case BWN_OFDM_RATE_54MB:
6564 		return (BWN_OFDM_RATE_48MB);
6565 	}
6566 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6567 	return (0);
6568 }
6569 
6570 static uint32_t
6571 bwn_pio_write_multi_4(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6572     uint32_t ctl, const void *_data, int len)
6573 {
6574 	struct bwn_softc *sc = mac->mac_sc;
6575 	uint32_t value = 0;
6576 	const uint8_t *data = _data;
6577 
6578 	ctl |= BWN_PIO8_TXCTL_0_7 | BWN_PIO8_TXCTL_8_15 |
6579 	    BWN_PIO8_TXCTL_16_23 | BWN_PIO8_TXCTL_24_31;
6580 	bwn_pio_write_4(mac, tq, BWN_PIO8_TXCTL, ctl);
6581 
6582 	siba_write_multi_4(sc->sc_dev, data, (len & ~3),
6583 	    tq->tq_base + BWN_PIO8_TXDATA);
6584 	if (len & 3) {
6585 		ctl &= ~(BWN_PIO8_TXCTL_8_15 | BWN_PIO8_TXCTL_16_23 |
6586 		    BWN_PIO8_TXCTL_24_31);
6587 		data = &(data[len - 1]);
6588 		switch (len & 3) {
6589 		case 3:
6590 			ctl |= BWN_PIO8_TXCTL_16_23;
6591 			value |= (uint32_t)(*data) << 16;
6592 			data--;
6593 		case 2:
6594 			ctl |= BWN_PIO8_TXCTL_8_15;
6595 			value |= (uint32_t)(*data) << 8;
6596 			data--;
6597 		case 1:
6598 			value |= (uint32_t)(*data);
6599 		}
6600 		bwn_pio_write_4(mac, tq, BWN_PIO8_TXCTL, ctl);
6601 		bwn_pio_write_4(mac, tq, BWN_PIO8_TXDATA, value);
6602 	}
6603 
6604 	return (ctl);
6605 }
6606 
6607 static void
6608 bwn_pio_write_4(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6609     uint16_t offset, uint32_t value)
6610 {
6611 
6612 	BWN_WRITE_4(mac, tq->tq_base + offset, value);
6613 }
6614 
6615 static uint16_t
6616 bwn_pio_write_multi_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6617     uint16_t ctl, const void *_data, int len)
6618 {
6619 	struct bwn_softc *sc = mac->mac_sc;
6620 	const uint8_t *data = _data;
6621 
6622 	ctl |= BWN_PIO_TXCTL_WRITELO | BWN_PIO_TXCTL_WRITEHI;
6623 	BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6624 
6625 	siba_write_multi_2(sc->sc_dev, data, (len & ~1),
6626 	    tq->tq_base + BWN_PIO_TXDATA);
6627 	if (len & 1) {
6628 		ctl &= ~BWN_PIO_TXCTL_WRITEHI;
6629 		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6630 		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data[len - 1]);
6631 	}
6632 
6633 	return (ctl);
6634 }
6635 
6636 static uint16_t
6637 bwn_pio_write_mbuf_2(struct bwn_mac *mac, struct bwn_pio_txqueue *tq,
6638     uint16_t ctl, struct mbuf *m0)
6639 {
6640 	int i, j = 0;
6641 	uint16_t data = 0;
6642 	const uint8_t *buf;
6643 	struct mbuf *m = m0;
6644 
6645 	ctl |= BWN_PIO_TXCTL_WRITELO | BWN_PIO_TXCTL_WRITEHI;
6646 	BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6647 
6648 	for (; m != NULL; m = m->m_next) {
6649 		buf = mtod(m, const uint8_t *);
6650 		for (i = 0; i < m->m_len; i++) {
6651 			if (!((j++) % 2))
6652 				data |= buf[i];
6653 			else {
6654 				data |= (buf[i] << 8);
6655 				BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data);
6656 				data = 0;
6657 			}
6658 		}
6659 	}
6660 	if (m0->m_pkthdr.len % 2) {
6661 		ctl &= ~BWN_PIO_TXCTL_WRITEHI;
6662 		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXCTL, ctl);
6663 		BWN_PIO_WRITE_2(mac, tq, BWN_PIO_TXDATA, data);
6664 	}
6665 
6666 	return (ctl);
6667 }
6668 
6669 static void
6670 bwn_set_slot_time(struct bwn_mac *mac, uint16_t time)
6671 {
6672 
6673 	/* XXX should exit if 5GHz band .. */
6674 	if (mac->mac_phy.type != BWN_PHYTYPE_G)
6675 		return;
6676 
6677 	BWN_WRITE_2(mac, 0x684, 510 + time);
6678 	/* Disabled in Linux b43, can adversely effect performance */
6679 #if 0
6680 	bwn_shm_write_2(mac, BWN_SHARED, 0x0010, time);
6681 #endif
6682 }
6683 
6684 static struct bwn_dma_ring *
6685 bwn_dma_select(struct bwn_mac *mac, uint8_t prio)
6686 {
6687 
6688 	if ((mac->mac_flags & BWN_MAC_FLAG_WME) == 0)
6689 		return (mac->mac_method.dma.wme[WME_AC_BE]);
6690 
6691 	switch (prio) {
6692 	case 3:
6693 		return (mac->mac_method.dma.wme[WME_AC_VO]);
6694 	case 2:
6695 		return (mac->mac_method.dma.wme[WME_AC_VI]);
6696 	case 0:
6697 		return (mac->mac_method.dma.wme[WME_AC_BE]);
6698 	case 1:
6699 		return (mac->mac_method.dma.wme[WME_AC_BK]);
6700 	}
6701 	KASSERT(0 == 1, ("%s:%d: fail", __func__, __LINE__));
6702 	return (NULL);
6703 }
6704 
6705 static int
6706 bwn_dma_getslot(struct bwn_dma_ring *dr)
6707 {
6708 	int slot;
6709 
6710 	BWN_ASSERT_LOCKED(dr->dr_mac->mac_sc);
6711 
6712 	KASSERT(dr->dr_tx, ("%s:%d: fail", __func__, __LINE__));
6713 	KASSERT(!(dr->dr_stop), ("%s:%d: fail", __func__, __LINE__));
6714 	KASSERT(bwn_dma_freeslot(dr) != 0, ("%s:%d: fail", __func__, __LINE__));
6715 
6716 	slot = bwn_dma_nextslot(dr, dr->dr_curslot);
6717 	KASSERT(!(slot & ~0x0fff), ("%s:%d: fail", __func__, __LINE__));
6718 	dr->dr_curslot = slot;
6719 	dr->dr_usedslot++;
6720 
6721 	return (slot);
6722 }
6723 
6724 static struct bwn_pio_txqueue *
6725 bwn_pio_parse_cookie(struct bwn_mac *mac, uint16_t cookie,
6726     struct bwn_pio_txpkt **pack)
6727 {
6728 	struct bwn_pio *pio = &mac->mac_method.pio;
6729 	struct bwn_pio_txqueue *tq = NULL;
6730 	unsigned int index;
6731 
6732 	switch (cookie & 0xf000) {
6733 	case 0x1000:
6734 		tq = &pio->wme[WME_AC_BK];
6735 		break;
6736 	case 0x2000:
6737 		tq = &pio->wme[WME_AC_BE];
6738 		break;
6739 	case 0x3000:
6740 		tq = &pio->wme[WME_AC_VI];
6741 		break;
6742 	case 0x4000:
6743 		tq = &pio->wme[WME_AC_VO];
6744 		break;
6745 	case 0x5000:
6746 		tq = &pio->mcast;
6747 		break;
6748 	}
6749 	KASSERT(tq != NULL, ("%s:%d: fail", __func__, __LINE__));
6750 	if (tq == NULL)
6751 		return (NULL);
6752 	index = (cookie & 0x0fff);
6753 	KASSERT(index < N(tq->tq_pkts), ("%s:%d: fail", __func__, __LINE__));
6754 	if (index >= N(tq->tq_pkts))
6755 		return (NULL);
6756 	*pack = &tq->tq_pkts[index];
6757 	KASSERT(*pack != NULL, ("%s:%d: fail", __func__, __LINE__));
6758 	return (tq);
6759 }
6760 
6761 static void
6762 bwn_txpwr(void *arg, int npending)
6763 {
6764 	struct bwn_mac *mac = arg;
6765 	struct bwn_softc *sc = mac->mac_sc;
6766 
6767 	BWN_LOCK(sc);
6768 	if (mac && mac->mac_status >= BWN_MAC_STATUS_STARTED &&
6769 	    mac->mac_phy.set_txpwr != NULL)
6770 		mac->mac_phy.set_txpwr(mac);
6771 	BWN_UNLOCK(sc);
6772 }
6773 
6774 static void
6775 bwn_task_15s(struct bwn_mac *mac)
6776 {
6777 	uint16_t reg;
6778 
6779 	if (mac->mac_fw.opensource) {
6780 		reg = bwn_shm_read_2(mac, BWN_SCRATCH, BWN_WATCHDOG_REG);
6781 		if (reg) {
6782 			bwn_restart(mac, "fw watchdog");
6783 			return;
6784 		}
6785 		bwn_shm_write_2(mac, BWN_SCRATCH, BWN_WATCHDOG_REG, 1);
6786 	}
6787 	if (mac->mac_phy.task_15s)
6788 		mac->mac_phy.task_15s(mac);
6789 
6790 	mac->mac_phy.txerrors = BWN_TXERROR_MAX;
6791 }
6792 
6793 static void
6794 bwn_task_30s(struct bwn_mac *mac)
6795 {
6796 
6797 	if (mac->mac_phy.type != BWN_PHYTYPE_G || mac->mac_noise.noi_running)
6798 		return;
6799 	mac->mac_noise.noi_running = 1;
6800 	mac->mac_noise.noi_nsamples = 0;
6801 
6802 	bwn_noise_gensample(mac);
6803 }
6804 
6805 static void
6806 bwn_task_60s(struct bwn_mac *mac)
6807 {
6808 
6809 	if (mac->mac_phy.task_60s)
6810 		mac->mac_phy.task_60s(mac);
6811 	bwn_phy_txpower_check(mac, BWN_TXPWR_IGNORE_TIME);
6812 }
6813 
6814 static void
6815 bwn_tasks(void *arg)
6816 {
6817 	struct bwn_mac *mac = arg;
6818 	struct bwn_softc *sc = mac->mac_sc;
6819 
6820 	BWN_ASSERT_LOCKED(sc);
6821 	if (mac->mac_status != BWN_MAC_STATUS_STARTED)
6822 		return;
6823 
6824 	if (mac->mac_task_state % 4 == 0)
6825 		bwn_task_60s(mac);
6826 	if (mac->mac_task_state % 2 == 0)
6827 		bwn_task_30s(mac);
6828 	bwn_task_15s(mac);
6829 
6830 	mac->mac_task_state++;
6831 	callout_reset(&sc->sc_task_ch, hz * 15, bwn_tasks, mac);
6832 }
6833 
6834 static int
6835 bwn_plcp_get_ofdmrate(struct bwn_mac *mac, struct bwn_plcp6 *plcp, uint8_t a)
6836 {
6837 	struct bwn_softc *sc = mac->mac_sc;
6838 
6839 	KASSERT(a == 0, ("not support APHY\n"));
6840 
6841 	switch (plcp->o.raw[0] & 0xf) {
6842 	case 0xb:
6843 		return (BWN_OFDM_RATE_6MB);
6844 	case 0xf:
6845 		return (BWN_OFDM_RATE_9MB);
6846 	case 0xa:
6847 		return (BWN_OFDM_RATE_12MB);
6848 	case 0xe:
6849 		return (BWN_OFDM_RATE_18MB);
6850 	case 0x9:
6851 		return (BWN_OFDM_RATE_24MB);
6852 	case 0xd:
6853 		return (BWN_OFDM_RATE_36MB);
6854 	case 0x8:
6855 		return (BWN_OFDM_RATE_48MB);
6856 	case 0xc:
6857 		return (BWN_OFDM_RATE_54MB);
6858 	}
6859 	device_printf(sc->sc_dev, "incorrect OFDM rate %d\n",
6860 	    plcp->o.raw[0] & 0xf);
6861 	return (-1);
6862 }
6863 
6864 static int
6865 bwn_plcp_get_cckrate(struct bwn_mac *mac, struct bwn_plcp6 *plcp)
6866 {
6867 	struct bwn_softc *sc = mac->mac_sc;
6868 
6869 	switch (plcp->o.raw[0]) {
6870 	case 0x0a:
6871 		return (BWN_CCK_RATE_1MB);
6872 	case 0x14:
6873 		return (BWN_CCK_RATE_2MB);
6874 	case 0x37:
6875 		return (BWN_CCK_RATE_5MB);
6876 	case 0x6e:
6877 		return (BWN_CCK_RATE_11MB);
6878 	}
6879 	device_printf(sc->sc_dev, "incorrect CCK rate %d\n", plcp->o.raw[0]);
6880 	return (-1);
6881 }
6882 
6883 static void
6884 bwn_rx_radiotap(struct bwn_mac *mac, struct mbuf *m,
6885     const struct bwn_rxhdr4 *rxhdr, struct bwn_plcp6 *plcp, int rate,
6886     int rssi, int noise)
6887 {
6888 	struct bwn_softc *sc = mac->mac_sc;
6889 	const struct ieee80211_frame_min *wh;
6890 	uint64_t tsf;
6891 	uint16_t low_mactime_now;
6892 	uint16_t mt;
6893 
6894 	if (htole16(rxhdr->phy_status0) & BWN_RX_PHYST0_SHORTPRMBL)
6895 		sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
6896 
6897 	wh = mtod(m, const struct ieee80211_frame_min *);
6898 	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
6899 		sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_WEP;
6900 
6901 	bwn_tsf_read(mac, &tsf);
6902 	low_mactime_now = tsf;
6903 	tsf = tsf & ~0xffffULL;
6904 
6905 	switch (mac->mac_fw.fw_hdr_format) {
6906 	case BWN_FW_HDR_351:
6907 	case BWN_FW_HDR_410:
6908 		mt = le16toh(rxhdr->ps4.r351.mac_time);
6909 		break;
6910 	case BWN_FW_HDR_598:
6911 		mt = le16toh(rxhdr->ps4.r598.mac_time);
6912 		break;
6913 	}
6914 
6915 	tsf += mt;
6916 	if (low_mactime_now < mt)
6917 		tsf -= 0x10000;
6918 
6919 	sc->sc_rx_th.wr_tsf = tsf;
6920 	sc->sc_rx_th.wr_rate = rate;
6921 	sc->sc_rx_th.wr_antsignal = rssi;
6922 	sc->sc_rx_th.wr_antnoise = noise;
6923 }
6924 
6925 static void
6926 bwn_tsf_read(struct bwn_mac *mac, uint64_t *tsf)
6927 {
6928 	uint32_t low, high;
6929 
6930 	KASSERT(siba_get_revid(mac->mac_sc->sc_dev) >= 3,
6931 	    ("%s:%d: fail", __func__, __LINE__));
6932 
6933 	low = BWN_READ_4(mac, BWN_REV3PLUS_TSF_LOW);
6934 	high = BWN_READ_4(mac, BWN_REV3PLUS_TSF_HIGH);
6935 	*tsf = high;
6936 	*tsf <<= 32;
6937 	*tsf |= low;
6938 }
6939 
6940 static int
6941 bwn_dma_attach(struct bwn_mac *mac)
6942 {
6943 	struct bwn_dma *dma = &mac->mac_method.dma;
6944 	struct bwn_softc *sc = mac->mac_sc;
6945 	bus_addr_t lowaddr = 0;
6946 	int error;
6947 
6948 	if (siba_get_type(sc->sc_dev) == SIBA_TYPE_PCMCIA || bwn_usedma == 0)
6949 		return (0);
6950 
6951 	KASSERT(siba_get_revid(sc->sc_dev) >= 5, ("%s: fail", __func__));
6952 
6953 	mac->mac_flags |= BWN_MAC_FLAG_DMA;
6954 
6955 	dma->dmatype = bwn_dma_gettype(mac);
6956 	if (dma->dmatype == BWN_DMA_30BIT)
6957 		lowaddr = BWN_BUS_SPACE_MAXADDR_30BIT;
6958 	else if (dma->dmatype == BWN_DMA_32BIT)
6959 		lowaddr = BUS_SPACE_MAXADDR_32BIT;
6960 	else
6961 		lowaddr = BUS_SPACE_MAXADDR;
6962 
6963 	/*
6964 	 * Create top level DMA tag
6965 	 */
6966 	error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev),	/* parent */
6967 			       BWN_ALIGN, 0,		/* alignment, bounds */
6968 			       lowaddr,			/* lowaddr */
6969 			       BUS_SPACE_MAXADDR,	/* highaddr */
6970 			       NULL, NULL,		/* filter, filterarg */
6971 			       BUS_SPACE_MAXSIZE,	/* maxsize */
6972 			       BUS_SPACE_UNRESTRICTED,	/* nsegments */
6973 			       BUS_SPACE_MAXSIZE,	/* maxsegsize */
6974 			       0,			/* flags */
6975 			       NULL, NULL,		/* lockfunc, lockarg */
6976 			       &dma->parent_dtag);
6977 	if (error) {
6978 		device_printf(sc->sc_dev, "can't create parent DMA tag\n");
6979 		return (error);
6980 	}
6981 
6982 	/*
6983 	 * Create TX/RX mbuf DMA tag
6984 	 */
6985 	error = bus_dma_tag_create(dma->parent_dtag,
6986 				1,
6987 				0,
6988 				BUS_SPACE_MAXADDR,
6989 				BUS_SPACE_MAXADDR,
6990 				NULL, NULL,
6991 				MCLBYTES,
6992 				1,
6993 				BUS_SPACE_MAXSIZE_32BIT,
6994 				0,
6995 				NULL, NULL,
6996 				&dma->rxbuf_dtag);
6997 	if (error) {
6998 		device_printf(sc->sc_dev, "can't create mbuf DMA tag\n");
6999 		goto fail0;
7000 	}
7001 	error = bus_dma_tag_create(dma->parent_dtag,
7002 				1,
7003 				0,
7004 				BUS_SPACE_MAXADDR,
7005 				BUS_SPACE_MAXADDR,
7006 				NULL, NULL,
7007 				MCLBYTES,
7008 				1,
7009 				BUS_SPACE_MAXSIZE_32BIT,
7010 				0,
7011 				NULL, NULL,
7012 				&dma->txbuf_dtag);
7013 	if (error) {
7014 		device_printf(sc->sc_dev, "can't create mbuf DMA tag\n");
7015 		goto fail1;
7016 	}
7017 
7018 	dma->wme[WME_AC_BK] = bwn_dma_ringsetup(mac, 0, 1, dma->dmatype);
7019 	if (!dma->wme[WME_AC_BK])
7020 		goto fail2;
7021 
7022 	dma->wme[WME_AC_BE] = bwn_dma_ringsetup(mac, 1, 1, dma->dmatype);
7023 	if (!dma->wme[WME_AC_BE])
7024 		goto fail3;
7025 
7026 	dma->wme[WME_AC_VI] = bwn_dma_ringsetup(mac, 2, 1, dma->dmatype);
7027 	if (!dma->wme[WME_AC_VI])
7028 		goto fail4;
7029 
7030 	dma->wme[WME_AC_VO] = bwn_dma_ringsetup(mac, 3, 1, dma->dmatype);
7031 	if (!dma->wme[WME_AC_VO])
7032 		goto fail5;
7033 
7034 	dma->mcast = bwn_dma_ringsetup(mac, 4, 1, dma->dmatype);
7035 	if (!dma->mcast)
7036 		goto fail6;
7037 	dma->rx = bwn_dma_ringsetup(mac, 0, 0, dma->dmatype);
7038 	if (!dma->rx)
7039 		goto fail7;
7040 
7041 	return (error);
7042 
7043 fail7:	bwn_dma_ringfree(&dma->mcast);
7044 fail6:	bwn_dma_ringfree(&dma->wme[WME_AC_VO]);
7045 fail5:	bwn_dma_ringfree(&dma->wme[WME_AC_VI]);
7046 fail4:	bwn_dma_ringfree(&dma->wme[WME_AC_BE]);
7047 fail3:	bwn_dma_ringfree(&dma->wme[WME_AC_BK]);
7048 fail2:	bus_dma_tag_destroy(dma->txbuf_dtag);
7049 fail1:	bus_dma_tag_destroy(dma->rxbuf_dtag);
7050 fail0:	bus_dma_tag_destroy(dma->parent_dtag);
7051 	return (error);
7052 }
7053 
7054 static struct bwn_dma_ring *
7055 bwn_dma_parse_cookie(struct bwn_mac *mac, const struct bwn_txstatus *status,
7056     uint16_t cookie, int *slot)
7057 {
7058 	struct bwn_dma *dma = &mac->mac_method.dma;
7059 	struct bwn_dma_ring *dr;
7060 	struct bwn_softc *sc = mac->mac_sc;
7061 
7062 	BWN_ASSERT_LOCKED(mac->mac_sc);
7063 
7064 	switch (cookie & 0xf000) {
7065 	case 0x1000:
7066 		dr = dma->wme[WME_AC_BK];
7067 		break;
7068 	case 0x2000:
7069 		dr = dma->wme[WME_AC_BE];
7070 		break;
7071 	case 0x3000:
7072 		dr = dma->wme[WME_AC_VI];
7073 		break;
7074 	case 0x4000:
7075 		dr = dma->wme[WME_AC_VO];
7076 		break;
7077 	case 0x5000:
7078 		dr = dma->mcast;
7079 		break;
7080 	default:
7081 		dr = NULL;
7082 		KASSERT(0 == 1,
7083 		    ("invalid cookie value %d", cookie & 0xf000));
7084 	}
7085 	*slot = (cookie & 0x0fff);
7086 	if (*slot < 0 || *slot >= dr->dr_numslots) {
7087 		/*
7088 		 * XXX FIXME: sometimes H/W returns TX DONE events duplicately
7089 		 * that it occurs events which have same H/W sequence numbers.
7090 		 * When it's occurred just prints a WARNING msgs and ignores.
7091 		 */
7092 		KASSERT(status->seq == dma->lastseq,
7093 		    ("%s:%d: fail", __func__, __LINE__));
7094 		device_printf(sc->sc_dev,
7095 		    "out of slot ranges (0 < %d < %d)\n", *slot,
7096 		    dr->dr_numslots);
7097 		return (NULL);
7098 	}
7099 	dma->lastseq = status->seq;
7100 	return (dr);
7101 }
7102 
7103 static void
7104 bwn_dma_stop(struct bwn_mac *mac)
7105 {
7106 	struct bwn_dma *dma;
7107 
7108 	if ((mac->mac_flags & BWN_MAC_FLAG_DMA) == 0)
7109 		return;
7110 	dma = &mac->mac_method.dma;
7111 
7112 	bwn_dma_ringstop(&dma->rx);
7113 	bwn_dma_ringstop(&dma->wme[WME_AC_BK]);
7114 	bwn_dma_ringstop(&dma->wme[WME_AC_BE]);
7115 	bwn_dma_ringstop(&dma->wme[WME_AC_VI]);
7116 	bwn_dma_ringstop(&dma->wme[WME_AC_VO]);
7117 	bwn_dma_ringstop(&dma->mcast);
7118 }
7119 
7120 static void
7121 bwn_dma_ringstop(struct bwn_dma_ring **dr)
7122 {
7123 
7124 	if (dr == NULL)
7125 		return;
7126 
7127 	bwn_dma_cleanup(*dr);
7128 }
7129 
7130 static void
7131 bwn_pio_stop(struct bwn_mac *mac)
7132 {
7133 	struct bwn_pio *pio;
7134 
7135 	if (mac->mac_flags & BWN_MAC_FLAG_DMA)
7136 		return;
7137 	pio = &mac->mac_method.pio;
7138 
7139 	bwn_destroy_queue_tx(&pio->mcast);
7140 	bwn_destroy_queue_tx(&pio->wme[WME_AC_VO]);
7141 	bwn_destroy_queue_tx(&pio->wme[WME_AC_VI]);
7142 	bwn_destroy_queue_tx(&pio->wme[WME_AC_BE]);
7143 	bwn_destroy_queue_tx(&pio->wme[WME_AC_BK]);
7144 }
7145 
7146 static void
7147 bwn_led_attach(struct bwn_mac *mac)
7148 {
7149 	struct bwn_softc *sc = mac->mac_sc;
7150 	const uint8_t *led_act = NULL;
7151 	uint16_t val[BWN_LED_MAX];
7152 	int i;
7153 
7154 	sc->sc_led_idle = (2350 * hz) / 1000;
7155 	sc->sc_led_blink = 1;
7156 
7157 	for (i = 0; i < N(bwn_vendor_led_act); ++i) {
7158 		if (siba_get_pci_subvendor(sc->sc_dev) ==
7159 		    bwn_vendor_led_act[i].vid) {
7160 			led_act = bwn_vendor_led_act[i].led_act;
7161 			break;
7162 		}
7163 	}
7164 	if (led_act == NULL)
7165 		led_act = bwn_default_led_act;
7166 
7167 	val[0] = siba_sprom_get_gpio0(sc->sc_dev);
7168 	val[1] = siba_sprom_get_gpio1(sc->sc_dev);
7169 	val[2] = siba_sprom_get_gpio2(sc->sc_dev);
7170 	val[3] = siba_sprom_get_gpio3(sc->sc_dev);
7171 
7172 	for (i = 0; i < BWN_LED_MAX; ++i) {
7173 		struct bwn_led *led = &sc->sc_leds[i];
7174 
7175 		if (val[i] == 0xff) {
7176 			led->led_act = led_act[i];
7177 		} else {
7178 			if (val[i] & BWN_LED_ACT_LOW)
7179 				led->led_flags |= BWN_LED_F_ACTLOW;
7180 			led->led_act = val[i] & BWN_LED_ACT_MASK;
7181 		}
7182 		led->led_mask = (1 << i);
7183 
7184 		if (led->led_act == BWN_LED_ACT_BLINK_SLOW ||
7185 		    led->led_act == BWN_LED_ACT_BLINK_POLL ||
7186 		    led->led_act == BWN_LED_ACT_BLINK) {
7187 			led->led_flags |= BWN_LED_F_BLINK;
7188 			if (led->led_act == BWN_LED_ACT_BLINK_POLL)
7189 				led->led_flags |= BWN_LED_F_POLLABLE;
7190 			else if (led->led_act == BWN_LED_ACT_BLINK_SLOW)
7191 				led->led_flags |= BWN_LED_F_SLOW;
7192 
7193 			if (sc->sc_blink_led == NULL) {
7194 				sc->sc_blink_led = led;
7195 				if (led->led_flags & BWN_LED_F_SLOW)
7196 					BWN_LED_SLOWDOWN(sc->sc_led_idle);
7197 			}
7198 		}
7199 
7200 		DPRINTF(sc, BWN_DEBUG_LED,
7201 		    "%dth led, act %d, lowact %d\n", i,
7202 		    led->led_act, led->led_flags & BWN_LED_F_ACTLOW);
7203 	}
7204 	callout_init_mtx(&sc->sc_led_blink_ch, &sc->sc_mtx, 0);
7205 }
7206 
7207 static __inline uint16_t
7208 bwn_led_onoff(const struct bwn_led *led, uint16_t val, int on)
7209 {
7210 
7211 	if (led->led_flags & BWN_LED_F_ACTLOW)
7212 		on = !on;
7213 	if (on)
7214 		val |= led->led_mask;
7215 	else
7216 		val &= ~led->led_mask;
7217 	return val;
7218 }
7219 
7220 static void
7221 bwn_led_newstate(struct bwn_mac *mac, enum ieee80211_state nstate)
7222 {
7223 	struct bwn_softc *sc = mac->mac_sc;
7224 	struct ieee80211com *ic = &sc->sc_ic;
7225 	uint16_t val;
7226 	int i;
7227 
7228 	if (nstate == IEEE80211_S_INIT) {
7229 		callout_stop(&sc->sc_led_blink_ch);
7230 		sc->sc_led_blinking = 0;
7231 	}
7232 
7233 	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0)
7234 		return;
7235 
7236 	val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7237 	for (i = 0; i < BWN_LED_MAX; ++i) {
7238 		struct bwn_led *led = &sc->sc_leds[i];
7239 		int on;
7240 
7241 		if (led->led_act == BWN_LED_ACT_UNKN ||
7242 		    led->led_act == BWN_LED_ACT_NULL)
7243 			continue;
7244 
7245 		if ((led->led_flags & BWN_LED_F_BLINK) &&
7246 		    nstate != IEEE80211_S_INIT)
7247 			continue;
7248 
7249 		switch (led->led_act) {
7250 		case BWN_LED_ACT_ON:    /* Always on */
7251 			on = 1;
7252 			break;
7253 		case BWN_LED_ACT_OFF:   /* Always off */
7254 		case BWN_LED_ACT_5GHZ:  /* TODO: 11A */
7255 			on = 0;
7256 			break;
7257 		default:
7258 			on = 1;
7259 			switch (nstate) {
7260 			case IEEE80211_S_INIT:
7261 				on = 0;
7262 				break;
7263 			case IEEE80211_S_RUN:
7264 				if (led->led_act == BWN_LED_ACT_11G &&
7265 				    ic->ic_curmode != IEEE80211_MODE_11G)
7266 					on = 0;
7267 				break;
7268 			default:
7269 				if (led->led_act == BWN_LED_ACT_ASSOC)
7270 					on = 0;
7271 				break;
7272 			}
7273 			break;
7274 		}
7275 
7276 		val = bwn_led_onoff(led, val, on);
7277 	}
7278 	BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7279 }
7280 
7281 static void
7282 bwn_led_event(struct bwn_mac *mac, int event)
7283 {
7284 	struct bwn_softc *sc = mac->mac_sc;
7285 	struct bwn_led *led = sc->sc_blink_led;
7286 	int rate;
7287 
7288 	if (event == BWN_LED_EVENT_POLL) {
7289 		if ((led->led_flags & BWN_LED_F_POLLABLE) == 0)
7290 			return;
7291 		if (ticks - sc->sc_led_ticks < sc->sc_led_idle)
7292 			return;
7293 	}
7294 
7295 	sc->sc_led_ticks = ticks;
7296 	if (sc->sc_led_blinking)
7297 		return;
7298 
7299 	switch (event) {
7300 	case BWN_LED_EVENT_RX:
7301 		rate = sc->sc_rx_rate;
7302 		break;
7303 	case BWN_LED_EVENT_TX:
7304 		rate = sc->sc_tx_rate;
7305 		break;
7306 	case BWN_LED_EVENT_POLL:
7307 		rate = 0;
7308 		break;
7309 	default:
7310 		panic("unknown LED event %d\n", event);
7311 		break;
7312 	}
7313 	bwn_led_blink_start(mac, bwn_led_duration[rate].on_dur,
7314 	    bwn_led_duration[rate].off_dur);
7315 }
7316 
7317 static void
7318 bwn_led_blink_start(struct bwn_mac *mac, int on_dur, int off_dur)
7319 {
7320 	struct bwn_softc *sc = mac->mac_sc;
7321 	struct bwn_led *led = sc->sc_blink_led;
7322 	uint16_t val;
7323 
7324 	val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7325 	val = bwn_led_onoff(led, val, 1);
7326 	BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7327 
7328 	if (led->led_flags & BWN_LED_F_SLOW) {
7329 		BWN_LED_SLOWDOWN(on_dur);
7330 		BWN_LED_SLOWDOWN(off_dur);
7331 	}
7332 
7333 	sc->sc_led_blinking = 1;
7334 	sc->sc_led_blink_offdur = off_dur;
7335 
7336 	callout_reset(&sc->sc_led_blink_ch, on_dur, bwn_led_blink_next, mac);
7337 }
7338 
7339 static void
7340 bwn_led_blink_next(void *arg)
7341 {
7342 	struct bwn_mac *mac = arg;
7343 	struct bwn_softc *sc = mac->mac_sc;
7344 	uint16_t val;
7345 
7346 	val = BWN_READ_2(mac, BWN_GPIO_CONTROL);
7347 	val = bwn_led_onoff(sc->sc_blink_led, val, 0);
7348 	BWN_WRITE_2(mac, BWN_GPIO_CONTROL, val);
7349 
7350 	callout_reset(&sc->sc_led_blink_ch, sc->sc_led_blink_offdur,
7351 	    bwn_led_blink_end, mac);
7352 }
7353 
7354 static void
7355 bwn_led_blink_end(void *arg)
7356 {
7357 	struct bwn_mac *mac = arg;
7358 	struct bwn_softc *sc = mac->mac_sc;
7359 
7360 	sc->sc_led_blinking = 0;
7361 }
7362 
7363 static int
7364 bwn_suspend(device_t dev)
7365 {
7366 	struct bwn_softc *sc = device_get_softc(dev);
7367 
7368 	BWN_LOCK(sc);
7369 	bwn_stop(sc);
7370 	BWN_UNLOCK(sc);
7371 	return (0);
7372 }
7373 
7374 static int
7375 bwn_resume(device_t dev)
7376 {
7377 	struct bwn_softc *sc = device_get_softc(dev);
7378 	int error = EDOOFUS;
7379 
7380 	BWN_LOCK(sc);
7381 	if (sc->sc_ic.ic_nrunning > 0)
7382 		error = bwn_init(sc);
7383 	BWN_UNLOCK(sc);
7384 	if (error == 0)
7385 		ieee80211_start_all(&sc->sc_ic);
7386 	return (0);
7387 }
7388 
7389 static void
7390 bwn_rfswitch(void *arg)
7391 {
7392 	struct bwn_softc *sc = arg;
7393 	struct bwn_mac *mac = sc->sc_curmac;
7394 	int cur = 0, prev = 0;
7395 
7396 	KASSERT(mac->mac_status >= BWN_MAC_STATUS_STARTED,
7397 	    ("%s: invalid MAC status %d", __func__, mac->mac_status));
7398 
7399 	if (mac->mac_phy.rev >= 3 || mac->mac_phy.type == BWN_PHYTYPE_LP
7400 	    || mac->mac_phy.type == BWN_PHYTYPE_N) {
7401 		if (!(BWN_READ_4(mac, BWN_RF_HWENABLED_HI)
7402 			& BWN_RF_HWENABLED_HI_MASK))
7403 			cur = 1;
7404 	} else {
7405 		if (BWN_READ_2(mac, BWN_RF_HWENABLED_LO)
7406 		    & BWN_RF_HWENABLED_LO_MASK)
7407 			cur = 1;
7408 	}
7409 
7410 	if (mac->mac_flags & BWN_MAC_FLAG_RADIO_ON)
7411 		prev = 1;
7412 
7413 	DPRINTF(sc, BWN_DEBUG_RESET, "%s: called; cur=%d, prev=%d\n",
7414 	    __func__, cur, prev);
7415 
7416 	if (cur != prev) {
7417 		if (cur)
7418 			mac->mac_flags |= BWN_MAC_FLAG_RADIO_ON;
7419 		else
7420 			mac->mac_flags &= ~BWN_MAC_FLAG_RADIO_ON;
7421 
7422 		device_printf(sc->sc_dev,
7423 		    "status of RF switch is changed to %s\n",
7424 		    cur ? "ON" : "OFF");
7425 		if (cur != mac->mac_phy.rf_on) {
7426 			if (cur)
7427 				bwn_rf_turnon(mac);
7428 			else
7429 				bwn_rf_turnoff(mac);
7430 		}
7431 	}
7432 
7433 	callout_schedule(&sc->sc_rfswitch_ch, hz);
7434 }
7435 
7436 static void
7437 bwn_sysctl_node(struct bwn_softc *sc)
7438 {
7439 	device_t dev = sc->sc_dev;
7440 	struct bwn_mac *mac;
7441 	struct bwn_stats *stats;
7442 
7443 	/* XXX assume that count of MAC is only 1. */
7444 
7445 	if ((mac = sc->sc_curmac) == NULL)
7446 		return;
7447 	stats = &mac->mac_stats;
7448 
7449 	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7450 	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7451 	    "linknoise", CTLFLAG_RW, &stats->rts, 0, "Noise level");
7452 	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7453 	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7454 	    "rts", CTLFLAG_RW, &stats->rts, 0, "RTS");
7455 	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
7456 	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7457 	    "rtsfail", CTLFLAG_RW, &stats->rtsfail, 0, "RTS failed to send");
7458 
7459 #ifdef BWN_DEBUG
7460 	SYSCTL_ADD_UINT(device_get_sysctl_ctx(dev),
7461 	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
7462 	    "debug", CTLFLAG_RW, &sc->sc_debug, 0, "Debug flags");
7463 #endif
7464 }
7465 
7466 static device_method_t bwn_methods[] = {
7467 	/* Device interface */
7468 	DEVMETHOD(device_probe,		bwn_probe),
7469 	DEVMETHOD(device_attach,	bwn_attach),
7470 	DEVMETHOD(device_detach,	bwn_detach),
7471 	DEVMETHOD(device_suspend,	bwn_suspend),
7472 	DEVMETHOD(device_resume,	bwn_resume),
7473 	DEVMETHOD_END
7474 };
7475 static driver_t bwn_driver = {
7476 	"bwn",
7477 	bwn_methods,
7478 	sizeof(struct bwn_softc)
7479 };
7480 static devclass_t bwn_devclass;
7481 DRIVER_MODULE(bwn, siba_bwn, bwn_driver, bwn_devclass, 0, 0);
7482 MODULE_DEPEND(bwn, siba_bwn, 1, 1, 1);
7483 MODULE_DEPEND(bwn, wlan, 1, 1, 1);		/* 802.11 media layer */
7484 MODULE_DEPEND(bwn, firmware, 1, 1, 1);		/* firmware support */
7485 MODULE_DEPEND(bwn, wlan_amrr, 1, 1, 1);
7486 MODULE_VERSION(bwn, 1);
7487